man.dnssec-verify.html revision 14a656f94b1fd0ababd84a772228dfa52276ba15
11e9368a226272085c337e9e74b79808c16fbdbaTinderbox User - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User - Permission to use, copy, modify, and/or distribute this software for any
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User - purpose with or without fee is hereby granted, provided that the above
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User - copyright notice and this permission notice appear in all copies.
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User - PERFORMANCE OF THIS SOFTWARE.
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<link rel="prev" href="man.dnssec-signzone.html" title="dnssec-signzone">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<link rel="next" href="man.lwresd.html" title="lwresd">
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<table width="100%" summary="Navigation header">
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<tr><th colspan="3" align="center"><span class="application">dnssec-verify</span></th></tr>
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<th width="60%" align="center">Manual pages</th>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<td width="20%" align="right">�<a accesskey="n" href="man.lwresd.html">Next</a>
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<a name="man.dnssec-verify"></a><div class="titlepage"></div>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt — DNSSEC zone verification tool
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>]
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>]
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <p><span class="command"><strong>dnssec-verify</strong></span>
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User verifies that a zone is fully signed for each algorithm found
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User chains are complete.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <div class="variablelist"><dl class="variablelist">
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User Specifies the DNS class of the zone.
6ea2385360e9e2167e65f9286447da9eea189457Tinderbox User<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
6ea2385360e9e2167e65f9286447da9eea189457Tinderbox User Specifies the cryptographic hardware to use, when applicable.
6ea2385360e9e2167e65f9286447da9eea189457Tinderbox User When BIND is built with OpenSSL PKCS#11 support, this defaults
6ea2385360e9e2167e65f9286447da9eea189457Tinderbox User to the string "pkcs11", which identifies an OpenSSL engine
6ea2385360e9e2167e65f9286447da9eea189457Tinderbox User that can drive a cryptographic accelerator or hardware service
6ea2385360e9e2167e65f9286447da9eea189457Tinderbox User module. When BIND is built with native PKCS#11 cryptography
6ea2385360e9e2167e65f9286447da9eea189457Tinderbox User (--enable-native-pkcs11), it defaults to the path of the PKCS#11
6ea2385360e9e2167e65f9286447da9eea189457Tinderbox User provider library specified via "--with-pkcs11".
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User The format of the input zone file.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Possible formats are <span class="command"><strong>"text"</strong></span> (default)
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt and <span class="command"><strong>"raw"</strong></span>.
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User This option is primarily intended to be used for dynamic
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User signed zones so that the dumped zone file in a non-text
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User format containing updates can be verified independently.
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User The use of this option does not make much sense for
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User non-dynamic zones.
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User The zone origin. If not specified, the name of the zone file
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User is assumed to be the origin.
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User Sets the debugging level.
6f1205897504b8f50b1785975482c995888dd630Tinderbox User Prints version information.
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User Only verify that the DNSKEY RRset is signed with key-signing
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User keys. Without this flag, it is assumed that the DNSKEY RRset
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User will be signed by all active keys. When this flag is set,
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User it will not be an error if the DNSKEY RRset is not signed
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User by zone-signing keys. This corresponds to the <code class="option">-x</code>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt option in <span class="command"><strong>dnssec-signzone</strong></span>.
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User Ignore the KSK flag on the keys when determining whether
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User the zone if correctly signed. Without this flag it is
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User assumed that there will be a non-revoked, self-signed
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User DNSKEY with the KSK flag set for each algorithm and
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User that RRsets other than DNSKEY RRset will be signed with
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User a different DNSKEY without the KSK flag set.
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User With this flag set, we only require that for each algorithm,
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User there will be at least one non-revoked, self-signed DNSKEY,
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User regardless of the KSK flag state, and that other RRsets
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User will be signed by a non-revoked key for the same algorithm
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User that includes the self-signed key; the same key may be used
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User for both purposes. This corresponds to the <code class="option">-z</code>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt option in <span class="command"><strong>dnssec-signzone</strong></span>.
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User The file containing the zone to be signed.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <span class="refentrytitle">dnssec-signzone</span>(8)
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<table width="100%" summary="Navigation footer">
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
cd32f419a8a5432fbb139f56ee73cbf68b9350ccTinderbox User<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<td width="40%" align="right">�<a accesskey="n" href="man.lwresd.html">Next</a>
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<span class="application">dnssec-signzone</span>�</td>
6e6f5e3e1111680cff3ef4a4fa27923548c88f70Tinderbox User<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<td width="40%" align="right" valign="top">�<span class="application">lwresd</span>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.0pre-alpha</p>