man.dnssec-coverage.html revision b68a2d272b958eb2c40cce59ee33e71c5f5f521b
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
71cef386fae61275b03e203825680b39fedaa8c6Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - Permission to use, copy, modify, and/or distribute this software for any
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - purpose with or without fee is hereby granted, provided that the above
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - copyright notice and this permission notice appear in all copies.
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User - PERFORMANCE OF THIS SOFTWARE.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<link rel="prev" href="man.dnssec-checkds.html" title="dnssec-checkds">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<link rel="next" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
9b469e3c59015b1a4899c9d8395168126fe094fdAutomatic Updater<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<table width="100%" summary="Navigation header">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<tr><th colspan="3" align="center"><span class="application">dnssec-coverage</span></th></tr>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<th width="60%" align="center">Manual pages</th>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="man.dnssec-coverage"></a><div class="titlepage"></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p><span class="application">dnssec-coverage</span> — checks future DNSKEY coverage for a zone</p>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code> [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>length</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [<code class="option">-k</code>] [<code class="option">-z</code>] [zone]</p></div>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p><span><strong class="command">dnssec-coverage</strong></span>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User verifies that the DNSSEC keys for a given zone or a set of zones
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User have timing metadata set properly to ensure no future lapses in DNSSEC
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User If <code class="option">zone</code> is specified, then keys found in
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the key repository matching that zone are scanned, and an ordered
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User list is generated of the events scheduled for that key (i.e.,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User publication, activation, inactivation, deletion). The list of
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User events is walked in order of occurrence. Warnings are generated
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User if any event is scheduled which could cause the zone to enter a
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User state in which validation failures might occur: for example, if
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the number of published or active keys for a given algorithm drops
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User to zero, or if a key is deleted from the zone too soon after a new
7e71f05d8643aca84914437c900cb716444507e4Tinderbox User key is rolled, and cached data signed by the prior key has not had
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User time to expire from resolver caches.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt If <code class="option">zone</code> is not specified, then all keys in the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews key repository will be scanned, and all zones for which there are
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews keys will be analyzed. (Note: This method of reporting is only
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt accurate if all the zones that have keys in a given repository
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt share the same TTL parameters.)
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Sets the directory in which keys can be found. Defaults to the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User current working directory.
7e71f05d8643aca84914437c900cb716444507e4Tinderbox User<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User If a <code class="option">file</code> is specified, then the zone is
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User read from that file; the largest TTL and the DNSKEY TTL are
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews determined directly from the zone data, and the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <code class="option">-m</code> and <code class="option">-d</code> options do
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User not need to be specified on the command line.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term">-l <em class="replaceable"><code>duration</code></em></span></dt>
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews The length of time to check for DNSSEC coverage. Key events
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews scheduled further into the future than <code class="option">duration</code>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt will be ignored, and assumed to be correct.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The value of <code class="option">duration</code> can be set in seconds,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt or in larger units of time by adding a suffix: 'mi' for minutes,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt 'h' for hours, 'd' for days, 'w' for weeks, 'mo' for months,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews 'y' for years.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="term">-m <em class="replaceable"><code>maximum TTL</code></em></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Sets the value to be used as the maximum TTL for the zone or
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews zones being analyzed when determining whether there is a
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews possibility of validation failure. When a zone-signing key is
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews deactivated, there must be enough time for the record in the
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User zone with the longest TTL to have expired from resolver caches
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews before that key can be purged from the DNSKEY RRset. If that
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt condition does not apply, a warning will be generated.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The length of the TTL can be set in seconds, or in larger units
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt of time by adding a suffix: 'mi' for minutes, 'h' for hours,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews This option is mandatory unless the <code class="option">-f</code> has
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User been used to specify a zone file. (If <code class="option">-f</code> has
b2f07642fd712c8fda81a116bcdde229ab291f33Tinderbox User been specified, this option may still be used; it will override
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User the value found in the file.)
b2f07642fd712c8fda81a116bcdde229ab291f33Tinderbox User<dt><span class="term">-d <em class="replaceable"><code>DNSKEY TTL</code></em></span></dt>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Sets the value to be used as the DNSKEY TTL for the zone or
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User zones being analyzed when determining whether there is a
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews possibility of validation failure. When a key is rolled (that
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User is, replaced with a new key), there must be enough time
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User for the old DNSKEY RRset to have expired from resolver caches
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews before the new key is activated and begins generating
b2f07642fd712c8fda81a116bcdde229ab291f33Tinderbox User signatures. If that condition does not apply, a warning
b2f07642fd712c8fda81a116bcdde229ab291f33Tinderbox User will be generated.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The length of the TTL can be set in seconds, or in larger units
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User of time by adding a suffix: 'mi' for minutes, 'h' for hours,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User This option is mandatory unless the <code class="option">-f</code> has
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User been used to specify a zone file, or a default key TTL was
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">dnssec-keygen</strong></span>. (If either of those is true,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User this option may still be used; it will override the value found
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews in the zone or key file.)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<dt><span class="term">-r <em class="replaceable"><code>resign interval</code></em></span></dt>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Sets the value to be used as the resign interval for the zone
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews or zones being analyzed when determining whether there is a
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews possibility of validation failure. This value defaults to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews 22.5 days, which is also the default in
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span><strong class="command">named</strong></span>. However, if it has been changed
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User by the <code class="option">sig-validity-interval</code> option in
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <code class="filename">named.conf</code>, then it should also be
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User changed here.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The length of the interval can be set in seconds, or in larger
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews units of time by adding a suffix: 'mi' for minutes, 'h' for hours,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User 'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Only check KSK coverage; ignore ZSK events. Cannot be
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Only check ZSK coverage; ignore KSK events. Cannot be
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term">-c <em class="replaceable"><code>compilezone path</code></em></span></dt>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Specifies a path to a <span><strong class="command">named-compilezone</strong></span> binary.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Used for testing.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p><span class="corpauthor">Internet Systems Consortium</span>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<table width="100%" summary="Navigation footer">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a accesskey="p" href="man.dnssec-checkds.html">Prev</a>�</td>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-dsfromkey.html">Next</a>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<span class="application">dnssec-checkds</span>�</td>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<td width="40%" align="right" valign="top">�<span class="application">dnssec-dsfromkey</span>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<p style="text-align: center;">BIND Version 9.11</p>