man.dnssec-coverage.html revision 95d0bdf2b427478c4a8ed8e06f9e316c7880140e
80833bb9a1bf25dcf19e814438a4b311d2e1f4cffuankg - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
16f23f109da3b82fdca8695789bec9f06e2e3383humbedooh - Copyright (C) 2000-2003 Internet Software Consortium.
5f066f496cd9f20a2a701255bc67d44e7cb46daetrawick - Permission to use, copy, modify, and/or distribute this software for any
5f066f496cd9f20a2a701255bc67d44e7cb46daetrawick - purpose with or without fee is hereby granted, provided that the above
2e15620d724fb8e3a5be183b917359a2fd6e9468covener - copyright notice and this permission notice appear in all copies.
2e15620d724fb8e3a5be183b917359a2fd6e9468covener - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
2e15620d724fb8e3a5be183b917359a2fd6e9468covener - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
b3a6e12c9577d9dfc6529bc5ad908f2073810df1kbrand - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
b3a6e12c9577d9dfc6529bc5ad908f2073810df1kbrand - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
b3a6e12c9577d9dfc6529bc5ad908f2073810df1kbrand - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
b3a6e12c9577d9dfc6529bc5ad908f2073810df1kbrand - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
3130cec5e1377ddd4203284dabf4dbc25cb759a0kbrand - PERFORMANCE OF THIS SOFTWARE.
3130cec5e1377ddd4203284dabf4dbc25cb759a0kbrand<!-- $Id$ -->
7b82bb697a4957f302e43df708dda478dea80e05trawick<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
1b988c41ee505962781d110a3e4c2c90f1ea0aa4covener<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
1b988c41ee505962781d110a3e4c2c90f1ea0aa4covener<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
1b988c41ee505962781d110a3e4c2c90f1ea0aa4covener<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
b352b6577c91eee28506a1d7db4b6951a45b8faekbrand<link rel="prev" href="man.dnssec-checkds.html" title="dnssec-checkds">
b352b6577c91eee28506a1d7db4b6951a45b8faekbrand<link rel="next" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
b352b6577c91eee28506a1d7db4b6951a45b8faekbrand<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e42e58d225104194ba5e894eb616be1ce2258e13jailletc<tr><th colspan="3" align="center"><span class="application">dnssec-coverage</span></th></tr>
10b01707470385065764d144de9bb5297fe8ecf2ylavic<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
10b01707470385065764d144de9bb5297fe8ecf2ylavic<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
c12b284247f00b5696adabb0b855ce0669465764ylavic<a name="man.dnssec-coverage"></a><div class="titlepage"></div>
6029353b43240f5fa7feede018ce0e3ab1600c96covener<p><span class="application">dnssec-coverage</span> — checks future DNSKEY coverage for a zone</p>
e1f43cac62f6960a6945e1fb6e3288ef7082ac53rpluem<div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code> [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>length</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [<code class="option">-k</code>] [<code class="option">-z</code>] [zone]</p></div>
f06e7c4b1bce6b6491e5de0b7998d3f5696b293dchrisd<p><span><strong class="command">dnssec-coverage</strong></span>
f06e7c4b1bce6b6491e5de0b7998d3f5696b293dchrisd verifies that the DNSSEC keys for a given zone or a set of zones
f06e7c4b1bce6b6491e5de0b7998d3f5696b293dchrisd have timing metadata set properly to ensure no future lapses in DNSSEC
111436a32ba1254291e4883292fb116d15fe8f64covener If <code class="option">zone</code> is specified, then keys found in
fce4949fb0b309a5744afcd503c6ed2d35621ee2covener the key repository matching that zone are scanned, and an ordered
fce4949fb0b309a5744afcd503c6ed2d35621ee2covener list is generated of the events scheduled for that key (i.e.,
fce4949fb0b309a5744afcd503c6ed2d35621ee2covener publication, activation, inactivation, deletion). The list of
fce4949fb0b309a5744afcd503c6ed2d35621ee2covener events is walked in order of occurrence. Warnings are generated
7b7430e701e9a31ce809da7c220bb8dfcf68c86etrawick if any event is scheduled which could cause the zone to enter a
7b7430e701e9a31ce809da7c220bb8dfcf68c86etrawick state in which validation failures might occur: for example, if
7b7430e701e9a31ce809da7c220bb8dfcf68c86etrawick the number of published or active keys for a given algorithm drops
ccc20788c1e5fc973f36df634399c89acb70deaejerenkrantz to zero, or if a key is deleted from the zone too soon after a new
ccc20788c1e5fc973f36df634399c89acb70deaejerenkrantz key is rolled, and cached data signed by the prior key has not had
ccc20788c1e5fc973f36df634399c89acb70deaejerenkrantz time to expire from resolver caches.
d522f82d7ada07a0cedb8dc6b71eacf3477d7188trawick If <code class="option">zone</code> is not specified, then all keys in the
1e1539a1e7d64b1af92636b81aac5aa50ee3163bminfrin key repository will be scanned, and all zones for which there are
1e1539a1e7d64b1af92636b81aac5aa50ee3163bminfrin keys will be analyzed. (Note: This method of reporting is only
1e1539a1e7d64b1af92636b81aac5aa50ee3163bminfrin accurate if all the zones that have keys in a given repository
273e512f20f262e5e2aa8e0e83371d1929fb76adjkaluza share the same TTL parameters.)
81849cd8925f6ffaf57412aaaac8a6df0d33cbb6covener<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
c8e4ae58e7b9eb27e5158d6980770d5064c50ba7trawick Sets the directory in which keys can be found. Defaults to the
c8e4ae58e7b9eb27e5158d6980770d5064c50ba7trawick current working directory.
c8e4ae58e7b9eb27e5158d6980770d5064c50ba7trawick<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
fe83f60b41477b14a37edcfcd1f7f5c5a1ebfe44minfrin If a <code class="option">file</code> is specified, then the zone is
fe83f60b41477b14a37edcfcd1f7f5c5a1ebfe44minfrin read from that file; the largest TTL and the DNSKEY TTL are
993d1261a278d7322bccef219101220b7b4fb8c5jkaluza determined directly from the zone data, and the
993d1261a278d7322bccef219101220b7b4fb8c5jkaluza <code class="option">-m</code> and <code class="option">-d</code> options do
993d1261a278d7322bccef219101220b7b4fb8c5jkaluza not need to be specified on the command line.
ba050a6f942b9fa0e81ed73437588005c569655ccovener<dt><span class="term">-l <em class="replaceable"><code>duration</code></em></span></dt>
ba050a6f942b9fa0e81ed73437588005c569655ccovener The length of time to check for DNSSEC coverage. Key events
ba050a6f942b9fa0e81ed73437588005c569655ccovener scheduled further into the future than <code class="option">duration</code>
ba050a6f942b9fa0e81ed73437588005c569655ccovener will be ignored, and assumed to be correct.
135ddda3a989215d2bedbcf1529bfb269c3eda23niq The value of <code class="option">duration</code> can be set in seconds,
1122585e1e00bb81e9d0f054bf5c318cec23aa7dminfrin or in larger units of time by adding a suffix: 'mi' for minutes,
1122585e1e00bb81e9d0f054bf5c318cec23aa7dminfrin 'h' for hours, 'd' for days, 'w' for weeks, 'mo' for months,
1122585e1e00bb81e9d0f054bf5c318cec23aa7dminfrin 'y' for years.
001a44c352f89c9ec332ffd3e0a6927dcd19432chumbedooh<dt><span class="term">-m <em class="replaceable"><code>maximum TTL</code></em></span></dt>
cc5a4a08dc9783fcbc52ce86f11e01c281a43810minfrin Sets the value to be used as the maximum TTL for the zone or
33124689065ade0dfc8c54d8ebb734f9439cb89btrawick zones being analyzed when determining whether there is a
33124689065ade0dfc8c54d8ebb734f9439cb89btrawick possibility of validation failure. When a zone-signing key is
33124689065ade0dfc8c54d8ebb734f9439cb89btrawick deactivated, there must be enough time for the record in the
9b0076ddd1103e5fa9c1f9bafde4b06ce244fbaecovener zone with the longest TTL to have expired from resolver caches
9b0076ddd1103e5fa9c1f9bafde4b06ce244fbaecovener before that key can be purged from the DNSKEY RRset. If that
9b0076ddd1103e5fa9c1f9bafde4b06ce244fbaecovener condition does not apply, a warning will be generated.
249d09d51808cb7981af99762c3b3736ca126cd5jkaluza The length of the TTL can be set in seconds, or in larger units
249d09d51808cb7981af99762c3b3736ca126cd5jkaluza of time by adding a suffix: 'mi' for minutes, 'h' for hours,
56589be3d7a3e9343370df240010c6928cc78b39jkaluza 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
652bacc79dd7f980249784cc8c4838e8f1de7e8acovener This option is mandatory unless the <code class="option">-f</code> has
652bacc79dd7f980249784cc8c4838e8f1de7e8acovener been used to specify a zone file. (If <code class="option">-f</code> has
652bacc79dd7f980249784cc8c4838e8f1de7e8acovener been specified, this option may still be used; it will override
652bacc79dd7f980249784cc8c4838e8f1de7e8acovener the value found in the file.)
77ca16c5676da23155311e13cee61e7eaba9fa3ejailletc<dt><span class="term">-d <em class="replaceable"><code>DNSKEY TTL</code></em></span></dt>
50cfe8bbbaf4279375802531268e2bf0155215fetrawick Sets the value to be used as the DNSKEY TTL for the zone or
50cfe8bbbaf4279375802531268e2bf0155215fetrawick zones being analyzed when determining whether there is a
50cfe8bbbaf4279375802531268e2bf0155215fetrawick possibility of validation failure. When a key is rolled (that
f87299dab99bc04b51a6b8cad51b6795db862c0atrawick is, replaced with a new key), there must be enough time
f87299dab99bc04b51a6b8cad51b6795db862c0atrawick for the old DNSKEY RRset to have expired from resolver caches
f87299dab99bc04b51a6b8cad51b6795db862c0atrawick before the new key is activated and begins generating
4d12805e6c18253040223ea637acd6b3b3c18f60jorton signatures. If that condition does not apply, a warning
4d12805e6c18253040223ea637acd6b3b3c18f60jorton will be generated.
4d12805e6c18253040223ea637acd6b3b3c18f60jorton The length of the TTL can be set in seconds, or in larger units
e5d909f2b06bd880fb3675cd49363df981caa631trawick of time by adding a suffix: 'mi' for minutes, 'h' for hours,
a4df2cd1e1391575a327c2a90ba4315f805a0a78covener 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
cb666b29f81df1d11d65002250153353568021fccovener This option is mandatory unless the <code class="option">-f</code> has
cb666b29f81df1d11d65002250153353568021fccovener been used to specify a zone file, or a default key TTL was
6a80c3c6f4b8ea7ba5e89402b8b779b09ce020e0covener <span><strong class="command">dnssec-keygen</strong></span>. (If either of those is true,
1c2cab00d988fc48cbe59032cf76cc0bab20d6f7covener this option may still be used; it will override the value found
6a80c3c6f4b8ea7ba5e89402b8b779b09ce020e0covener in the zone or key file.)
75a230a728338d84dcfe81edd375352f34de22d0covener<dt><span class="term">-r <em class="replaceable"><code>resign interval</code></em></span></dt>
1f50dc34ae069adeed20b2986e5ffdefa5c410e0covener Sets the value to be used as the resign interval for the zone
63a5ea80bddcc84a462e40f402b4f330e0e05411covener or zones being analyzed when determining whether there is a
63a5ea80bddcc84a462e40f402b4f330e0e05411covener possibility of validation failure. This value defaults to
63a5ea80bddcc84a462e40f402b4f330e0e05411covener 22.5 days, which is also the default in
63a5ea80bddcc84a462e40f402b4f330e0e05411covener <span><strong class="command">named</strong></span>. However, if it has been changed
986f3ea2c314d4d4b3b937149853a0f23f6119aaminfrin by the <code class="option">sig-validity-interval</code> option in
986f3ea2c314d4d4b3b937149853a0f23f6119aaminfrin <code class="filename">named.conf</code>, then it should also be
986f3ea2c314d4d4b3b937149853a0f23f6119aaminfrin changed here.
65a4e663b82f8bce28ac22ab2edfd7502de36998sf The length of the interval can be set in seconds, or in larger
65a4e663b82f8bce28ac22ab2edfd7502de36998sf units of time by adding a suffix: 'mi' for minutes, 'h' for hours,
c7de1955eb0eaeabf7042902476397692672d549sf 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
a511a29faf2ff7ead3b67680154a624effb31aafminfrin Only check KSK coverage; ignore ZSK events. Cannot be
63921358ef93fcb41bc71d9894221ba3d7fbb87bminfrin Only check ZSK coverage; ignore KSK events. Cannot be
deec48c67d4786bc77112ffbf3a4e70b931097edminfrin<dt><span class="term">-c <em class="replaceable"><code>compilezone path</code></em></span></dt>
6d601599d3d65df0410eae6e573e75b2dbfb1fb4minfrin Specifies a path to a <span><strong class="command">named-compilezone</strong></span> binary.
6d601599d3d65df0410eae6e573e75b2dbfb1fb4minfrin Used for testing.
684e0cfc200f66287a93bbd1708d1dd8a92a7eefcovener <span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,
684e0cfc200f66287a93bbd1708d1dd8a92a7eefcovener <span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
5c43d2fb853f84497b5ece2d414ef9484aa87e5fsf <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
05a5a9c3e16f21566e1b61f4bd68025ce1b741ccjoes <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>
ef82e8fa164e0a1f8b813f7deb6b7ead96018c94niq<p><span class="corpauthor">Internet Systems Consortium</span>
eafcc0ebf263d0ba69855b6e10958c4c1a2361bdsf<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
eafcc0ebf263d0ba69855b6e10958c4c1a2361bdsf<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
eafcc0ebf263d0ba69855b6e10958c4c1a2361bdsf<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
4576c1a9ef54cd1e5555ee07d016a7f559f80338sf<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
4576c1a9ef54cd1e5555ee07d016a7f559f80338sf<td width="40%" align="right" valign="top">�<span class="application">dnssec-dsfromkey</span>