man.dnssec-coverage.html revision 871ab4edd87bc1c047658c3e2b92c629c58dbb38
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - Copyright (C) 2000-2003 Internet Software Consortium.
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - Permission to use, copy, modify, and/or distribute this software for any
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - purpose with or without fee is hereby granted, provided that the above
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - copyright notice and this permission notice appear in all copies.
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen - PERFORMANCE OF THIS SOFTWARE.
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen<link rel="prev" href="man.dnssec-checkds.html" title="dnssec-checkds">
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye<link rel="next" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen<table width="100%" summary="Navigation header">
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco<tr><th colspan="3" align="center"><span class="application">dnssec-coverage</span></th></tr>
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
772d81ed3968926175c33c799196ba28082f0de6Jorgen Austvik<th width="60%" align="center">Manual pages</th>
772d81ed3968926175c33c799196ba28082f0de6Jorgen Austvik<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen<a name="man.dnssec-coverage"></a><div class="titlepage"></div>
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen<p><span class="application">dnssec-coverage</span> — checks future DNSKEY coverage for a zone</p>
8ea4b8d9796de43443cdf7b66e3f185aedf7b570Jens Elkner<div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code> [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>length</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [<code class="option">-k</code>] [<code class="option">-z</code>] [zone]</p></div>
f60d84bfe9ece4779c642dfe4849acd35ade9388Trond Norbye<p><span><strong class="command">dnssec-coverage</strong></span>
f60d84bfe9ece4779c642dfe4849acd35ade9388Trond Norbye verifies that the DNSSEC keys for a given zone or a set of zones
010ed6481353f3665275befa12f58212b248f15bTrond Norbye have timing metadata set properly to ensure no future lapses in DNSSEC
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik If <code class="option">zone</code> is specified, then keys found in
8ea4b8d9796de43443cdf7b66e3f185aedf7b570Jens Elkner the key repository matching that zone are scanned, and an ordered
8ea4b8d9796de43443cdf7b66e3f185aedf7b570Jens Elkner list is generated of the events scheduled for that key (i.e.,
8ea4b8d9796de43443cdf7b66e3f185aedf7b570Jens Elkner publication, activation, inactivation, deletion). The list of
8ea4b8d9796de43443cdf7b66e3f185aedf7b570Jens Elkner events is walked in order of occurrence. Warnings are generated
8ea4b8d9796de43443cdf7b66e3f185aedf7b570Jens Elkner if any event is scheduled which could cause the zone to enter a
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik state in which validation failures might occur: for example, if
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik the number of published or active keys for a given algorithm drops
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen to zero, or if a key is deleted from the zone too soon after a new
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen key is rolled, and cached data signed by the prior key has not had
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen time to expire from resolver caches.
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen If <code class="option">zone</code> is not specified, then all keys in the
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen key repository will be scanned, and all zones for which there are
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen keys will be analyzed. (Note: This method of reporting is only
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen accurate if all the zones that have keys in a given repository
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen share the same TTL parameters.)
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
9088add4cb246b415c19479e94c10f0281d6c92fLubos Kosco Sets the directory in which keys can be found. Defaults to the
d8686bd0a12811810b7cf93beda3c01b635c1a81Knut Anders Hatlen current working directory.
772d81ed3968926175c33c799196ba28082f0de6Jorgen Austvik<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
772d81ed3968926175c33c799196ba28082f0de6Jorgen Austvik If a <code class="option">file</code> is specified, then the zone is
772d81ed3968926175c33c799196ba28082f0de6Jorgen Austvik read from that file; the largest TTL and the DNSKEY TTL are
772d81ed3968926175c33c799196ba28082f0de6Jorgen Austvik determined directly from the zone data, and the
8ea4b8d9796de43443cdf7b66e3f185aedf7b570Jens Elkner <code class="option">-m</code> and <code class="option">-d</code> options do
8ea4b8d9796de43443cdf7b66e3f185aedf7b570Jens Elkner not need to be specified on the command line.
772d81ed3968926175c33c799196ba28082f0de6Jorgen Austvik<dt><span class="term">-l <em class="replaceable"><code>duration</code></em></span></dt>
772d81ed3968926175c33c799196ba28082f0de6Jorgen Austvik The length of time to check for DNSSEC coverage. Key events
772d81ed3968926175c33c799196ba28082f0de6Jorgen Austvik scheduled further into the future than <code class="option">duration</code>
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik will be ignored, and assumed to be correct.
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik The value of <code class="option">duration</code> can be set in seconds,
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik or in larger units of time by adding a suffix: 'mi' for minutes,
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik 'h' for hours, 'd' for days, 'w' for weeks, 'mo' for months,
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik 'y' for years.
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik<dt><span class="term">-m <em class="replaceable"><code>maximum TTL</code></em></span></dt>
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik Sets the value to be used as the maximum TTL for the zone or
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik zones being analyzed when determining whether there is a
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik possibility of validation failure. When a zone-signing key is
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik deactivated, there must be enough time for the record in the
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik zone with the longest TTL to have expired from resolver caches
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik before that key can be purged from the DNSKEY RRset. If that
8ea4b8d9796de43443cdf7b66e3f185aedf7b570Jens Elkner condition does not apply, a warning will be generated.
b9f591b5eae280782a5927f84206e1a04303d832Lubos Kosco The length of the TTL can be set in seconds, or in larger units
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik of time by adding a suffix: 'mi' for minutes, 'h' for hours,
499692667e24778cf85bd08d2572f8bbd320ef19Lubos Kosco 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco This option is mandatory unless the <code class="option">-f</code> has
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco been used to specify a zone file. (If <code class="option">-f</code> has
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco been specified, this option may still be used; it will override
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco the value found in the file.)
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco<dt><span class="term">-d <em class="replaceable"><code>DNSKEY TTL</code></em></span></dt>
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco Sets the value to be used as the DNSKEY TTL for the zone or
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco zones being analyzed when determining whether there is a
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco possibility of validation failure. When a key is rolled (that
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco is, replaced with a new key), there must be enough time
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco for the old DNSKEY RRset to have expired from resolver caches
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco before the new key is activated and begins generating
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco signatures. If that condition does not apply, a warning
3ad4470221a3aaf1bd926f382f0ac8fc2eee7fa6Lubos Kosco will be generated.
499692667e24778cf85bd08d2572f8bbd320ef19Lubos Kosco The length of the TTL can be set in seconds, or in larger units
00c78048c658bae03904b3e59e8e7640eb93572dLubos Kosco of time by adding a suffix: 'mi' for minutes, 'h' for hours,
00c78048c658bae03904b3e59e8e7640eb93572dLubos Kosco 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik This option is mandatory unless the <code class="option">-f</code> has
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik been used to specify a zone file, or a default key TTL was
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik set with the <code class="option">-L</code> to
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik <span><strong class="command">dnssec-keygen</strong></span>. (If either of those is true,
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik this option may still be used; it will override the value found
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik in the zone or key file.)
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye<dt><span class="term">-r <em class="replaceable"><code>resign interval</code></em></span></dt>
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye Sets the value to be used as the resign interval for the zone
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye or zones being analyzed when determining whether there is a
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye possibility of validation failure. This value defaults to
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye 22.5 days, which is also the default in
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye <span><strong class="command">named</strong></span>. However, if it has been changed
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye by the <code class="option">sig-validity-interval</code> option in
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye <code class="filename">named.conf</code>, then it should also be
8ea4b8d9796de43443cdf7b66e3f185aedf7b570Jens Elkner changed here.
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye The length of the interval can be set in seconds, or in larger
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye units of time by adding a suffix: 'mi' for minutes, 'h' for hours,
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye Only check KSK coverage; ignore ZSK events. Cannot be
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye Only check ZSK coverage; ignore KSK events. Cannot be
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye<dt><span class="term">-c <em class="replaceable"><code>compilezone path</code></em></span></dt>
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye Specifies a path to a <span><strong class="command">named-compilezone</strong></span> binary.
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye Used for testing.
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye <span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye <span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>
c89e30e197b074b11a97a612f071604923fcc168Trond Norbye<p><span class="corpauthor">Internet Systems Consortium</span>
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik<table width="100%" summary="Navigation footer">
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik<span class="application">dnssec-checkds</span>�</td>
998bdbc74fee32f35e3130fe3dbc332b06865b80Knut Anders Hatlen<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
998bdbc74fee32f35e3130fe3dbc332b06865b80Knut Anders Hatlen<td width="40%" align="right" valign="top">�<span class="application">dnssec-dsfromkey</span>
c5ad3d8c26756adff5057ea2dc89fa3f6a2b79c3Jorgen Austvik<p style="text-align: center;">BIND 9.11.0pre-alpha</p>