man.dnssec-coverage.html revision 947d37484ed01966a9e89dd27f62c1b427324dc2
54cdd2b3070640311cd9ddeb6ca3514b3116e62bAutomatic Updater - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont - Copyright (C) 2000-2003 Internet Software Consortium.
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont - Permission to use, copy, modify, and/or distribute this software for any
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont - purpose with or without fee is hereby granted, provided that the above
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont - copyright notice and this permission notice appear in all copies.
db0008c4486414b81e90dca9938e1fc2320e5133Automatic Updater - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
db0008c4486414b81e90dca9938e1fc2320e5133Automatic Updater - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
db0008c4486414b81e90dca9938e1fc2320e5133Automatic Updater - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
db0008c4486414b81e90dca9938e1fc2320e5133Automatic Updater - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
db0008c4486414b81e90dca9938e1fc2320e5133Automatic Updater - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
db0008c4486414b81e90dca9938e1fc2320e5133Automatic Updater - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont - PERFORMANCE OF THIS SOFTWARE.
8a198fa776a09beb4dabf40b73a54d9c7bd70ac9Evan Hunt<!-- $Id$ -->
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<link rel="prev" href="man.dnssec-checkds.html" title="dnssec-checkds">
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<link rel="next" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<table width="100%" summary="Navigation header">
22b23fb59dcedebdb735ec1406d0557225b649abEvan Hunt<tr><th colspan="3" align="center"><span class="application">dnssec-coverage</span></th></tr>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<a name="man.dnssec-coverage"></a><div class="titlepage"></div>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<p><span class="application">dnssec-coverage</span> — checks future DNSKEY coverage for a zone</p>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code> [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>length</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [<code class="option">-k</code>] [<code class="option">-z</code>] [zone]</p></div>
d1f39121a69b6afa6c0c9e44eceb60910d1d7f81Evan Hunt<p><span><strong class="command">dnssec-coverage</strong></span>
d1f39121a69b6afa6c0c9e44eceb60910d1d7f81Evan Hunt verifies that the DNSSEC keys for a given zone or a set of zones
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews have timing metadata set properly to ensure no future lapses in DNSSEC
debd489a44363870f96f75818e89ec27d3cab736Francis Dupont If <code class="option">zone</code> is specified, then keys found in
debd489a44363870f96f75818e89ec27d3cab736Francis Dupont the key repository matching that zone are scanned, and an ordered
debd489a44363870f96f75818e89ec27d3cab736Francis Dupont list is generated of the events scheduled for that key (i.e.,
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont publication, activation, inactivation, deletion). The list of
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont events is walked in order of occurrence. Warnings are generated
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont if any event is scheduled which could cause the zone to enter a
d1f39121a69b6afa6c0c9e44eceb60910d1d7f81Evan Hunt state in which validation failures might occur: for example, if
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont the number of published or active keys for a given algorithm drops
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont to zero, or if a key is deleted from the zone too soon after a new
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont key is rolled, and cached data signed by the prior key has not had
210970a2488bb4c7eb679b3cbd918a9031fc5649Francis Dupont time to expire from resolver caches.
d1f39121a69b6afa6c0c9e44eceb60910d1d7f81Evan Hunt If <code class="option">zone</code> is not specified, then all keys in the
d1f39121a69b6afa6c0c9e44eceb60910d1d7f81Evan Hunt key repository will be scanned, and all zones for which there are
d1f39121a69b6afa6c0c9e44eceb60910d1d7f81Evan Hunt keys will be analyzed. (Note: This method of reporting is only
d1f39121a69b6afa6c0c9e44eceb60910d1d7f81Evan Hunt accurate if all the zones that have keys in a given repository
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont share the same TTL parameters.)
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the directory in which keys can be found. Defaults to the
8a198fa776a09beb4dabf40b73a54d9c7bd70ac9Evan Hunt current working directory.
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont If a <code class="option">file</code> is specified, then the zone is
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont read from that file; the largest TTL and the DNSKEY TTL are
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont determined directly from the zone data, and the
8a198fa776a09beb4dabf40b73a54d9c7bd70ac9Evan Hunt <code class="option">-m</code> and <code class="option">-d</code> options do
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont not need to be specified on the command line.
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont<dt><span class="term">-l <em class="replaceable"><code>duration</code></em></span></dt>
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt The length of time to check for DNSSEC coverage. Key events
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont scheduled further into the future than <code class="option">duration</code>
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt will be ignored, and assumed to be correct.
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont The value of <code class="option">duration</code> can be set in seconds,
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont or in larger units of time by adding a suffix: 'mi' for minutes,
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont 'h' for hours, 'd' for days, 'w' for weeks, 'mo' for months,
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont 'y' for years.
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<dt><span class="term">-m <em class="replaceable"><code>maximum TTL</code></em></span></dt>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont Sets the value to be used as the maximum TTL for the zone or
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont zones being analyzed when determining whether there is a
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont possibility of validation failure. When a zone-signing key is
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont deactivated, there must be enough time for the record in the
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont zone with the longest TTL to have expired from resolver caches
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont before that key can be purged from the DNSKEY RRset. If that
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont condition does not apply, a warning will be generated.
8a198fa776a09beb4dabf40b73a54d9c7bd70ac9Evan Hunt The length of the TTL can be set in seconds, or in larger units
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont of time by adding a suffix: 'mi' for minutes, 'h' for hours,
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont This option is mandatory unless the <code class="option">-f</code> has
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont been used to specify a zone file. (If <code class="option">-f</code> has
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont been specified, this option may still be used; it will override
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont the value found in the file.)
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<dt><span class="term">-d <em class="replaceable"><code>DNSKEY TTL</code></em></span></dt>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont Sets the value to be used as the DNSKEY TTL for the zone or
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont zones being analyzed when determining whether there is a
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont possibility of validation failure. When a key is rolled (that
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont is, replaced with a new key), there must be enough time
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont for the old DNSKEY RRset to have expired from resolver caches
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt before the new key is activated and begins generating
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont signatures. If that condition does not apply, a warning
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont will be generated.
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont The length of the TTL can be set in seconds, or in larger units
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt of time by adding a suffix: 'mi' for minutes, 'h' for hours,
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
8a198fa776a09beb4dabf40b73a54d9c7bd70ac9Evan Hunt This option is mandatory unless the <code class="option">-f</code> has
8a198fa776a09beb4dabf40b73a54d9c7bd70ac9Evan Hunt been used to specify a zone file, or a default key TTL was
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont <span><strong class="command">dnssec-keygen</strong></span>. (If either of those is true,
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont this option may still be used; it will override the value found
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont in the zone or key file.)
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<dt><span class="term">-r <em class="replaceable"><code>resign interval</code></em></span></dt>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont Sets the value to be used as the resign interval for the zone
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont or zones being analyzed when determining whether there is a
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont possibility of validation failure. This value defaults to
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont 22.5 days, which is also the default in
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont <span><strong class="command">named</strong></span>. However, if it has been changed
8a198fa776a09beb4dabf40b73a54d9c7bd70ac9Evan Hunt by the <code class="option">sig-validity-interval</code> option in
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont <code class="filename">named.conf</code>, then it should also be
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont changed here.
d1f39121a69b6afa6c0c9e44eceb60910d1d7f81Evan Hunt The length of the interval can be set in seconds, or in larger
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont units of time by adding a suffix: 'mi' for minutes, 'h' for hours,
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont Only check KSK coverage; ignore ZSK events. Cannot be
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont Only check ZSK coverage; ignore KSK events. Cannot be
4bf4beede27aff2da69d31c5baa995f594838378Mark Andrews<dt><span class="term">-c <em class="replaceable"><code>compilezone path</code></em></span></dt>
4bf4beede27aff2da69d31c5baa995f594838378Mark Andrews Specifies a path to a <span><strong class="command">named-compilezone</strong></span> binary.
1f821c10583d9cddbaf3626a96ff8cf10cdb645bFrancis Dupont Used for testing.
8f0502e922120f27207fbf6b6dda18f1112e486cEvan Hunt <span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,
8f0502e922120f27207fbf6b6dda18f1112e486cEvan Hunt <span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
e3b59e4af757d4b26ecb96e65f9953488283c216Evan Hunt <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
8f0502e922120f27207fbf6b6dda18f1112e486cEvan Hunt <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<p><span class="corpauthor">Internet Systems Consortium</span>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<table width="100%" summary="Navigation footer">
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<span class="application">dnssec-checkds</span>�</td>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<td width="40%" align="right" valign="top">�<span class="application">dnssec-dsfromkey</span>
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt<p style="text-align: center;">BIND 9.11.0pre-alpha</p>