man.dnssec-verify.html revision 14a656f94b1fd0ababd84a772228dfa52276ba15
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - Copyright (C) 2000-2003 Internet Software Consortium.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - Permission to use, copy, modify, and/or distribute this software for any
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - purpose with or without fee is hereby granted, provided that the above
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - copyright notice and this permission notice appear in all copies.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin - PERFORMANCE OF THIS SOFTWARE.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<link rel="prev" href="man.dnssec-signzone.html" title="dnssec-signzone">
fb09f5aad449c97fe309678f3f604982b563a96fMadhav Suresh<link rel="next" href="man.lwresd.html" title="lwresd">
fb09f5aad449c97fe309678f3f604982b563a96fMadhav Suresh<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<tr><th colspan="3" align="center"><span class="application">dnssec-verify</span></th></tr>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<td width="20%" align="right">�<a accesskey="n" href="man.lwresd.html">Next</a>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<a name="man.dnssec-verify"></a><div class="titlepage"></div>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin — DNSSEC zone verification tool
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>]
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>]
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin <p><span class="command"><strong>dnssec-verify</strong></span>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin verifies that a zone is fully signed for each algorithm found
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin chains are complete.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin Specifies the DNS class of the zone.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin Specifies the cryptographic hardware to use, when applicable.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin When BIND is built with OpenSSL PKCS#11 support, this defaults
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin to the string "pkcs11", which identifies an OpenSSL engine
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin that can drive a cryptographic accelerator or hardware service
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin module. When BIND is built with native PKCS#11 cryptography
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin (--enable-native-pkcs11), it defaults to the path of the PKCS#11
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin provider library specified via "--with-pkcs11".
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin The format of the input zone file.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin Possible formats are <span class="command"><strong>"text"</strong></span> (default)
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin and <span class="command"><strong>"raw"</strong></span>.
c2e6a7d6abc139a8d59fca4857d6276f3b70ddf9perrin This option is primarily intended to be used for dynamic
c2e6a7d6abc139a8d59fca4857d6276f3b70ddf9perrin signed zones so that the dumped zone file in a non-text
c2e6a7d6abc139a8d59fca4857d6276f3b70ddf9perrin format containing updates can be verified independently.
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum The use of this option does not make much sense for
c2e6a7d6abc139a8d59fca4857d6276f3b70ddf9perrin non-dynamic zones.
c2e6a7d6abc139a8d59fca4857d6276f3b70ddf9perrin<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
c2e6a7d6abc139a8d59fca4857d6276f3b70ddf9perrin The zone origin. If not specified, the name of the zone file
c2e6a7d6abc139a8d59fca4857d6276f3b70ddf9perrin is assumed to be the origin.
c2e6a7d6abc139a8d59fca4857d6276f3b70ddf9perrin<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin Sets the debugging level.
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum Prints version information.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin Only verify that the DNSKEY RRset is signed with key-signing
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin keys. Without this flag, it is assumed that the DNSKEY RRset
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin will be signed by all active keys. When this flag is set,
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin it will not be an error if the DNSKEY RRset is not signed
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin by zone-signing keys. This corresponds to the <code class="option">-x</code>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin option in <span class="command"><strong>dnssec-signzone</strong></span>.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin Ignore the KSK flag on the keys when determining whether
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin the zone if correctly signed. Without this flag it is
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin assumed that there will be a non-revoked, self-signed
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin DNSKEY with the KSK flag set for each algorithm and
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin that RRsets other than DNSKEY RRset will be signed with
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin a different DNSKEY without the KSK flag set.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin With this flag set, we only require that for each algorithm,
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin there will be at least one non-revoked, self-signed DNSKEY,
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin regardless of the KSK flag state, and that other RRsets
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin will be signed by a non-revoked key for the same algorithm
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin that includes the self-signed key; the same key may be used
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin for both purposes. This corresponds to the <code class="option">-z</code>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin option in <span class="command"><strong>dnssec-signzone</strong></span>.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin The file containing the zone to be signed.
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin <span class="refentrytitle">dnssec-signzone</span>(8)
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<td width="40%" align="right">�<a accesskey="n" href="man.lwresd.html">Next</a>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<span class="application">dnssec-signzone</span>�</td>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<td width="40%" align="right" valign="top">�<span class="application">lwresd</span>
104e2ed78d9ef0a0f89f320108b8ca29ca3850d5perrin<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.0pre-alpha</p>