man.dnssec-verify.html revision 71cef386fae61275b03e203825680b39fedaa8c6
689023771c563d8660e45d439a207e06e96de28fMark Andrews<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Copyright (C) 2000-2018 Internet Systems Consortium, Inc. ("ISC")
689023771c563d8660e45d439a207e06e96de28fMark Andrews - This Source Code Form is subject to the terms of the Mozilla Public
689023771c563d8660e45d439a207e06e96de28fMark Andrews - License, v. 2.0. If a copy of the MPL was not distributed with this
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - file, You can obtain one at http://mozilla.org/MPL/2.0/.
689023771c563d8660e45d439a207e06e96de28fMark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
689023771c563d8660e45d439a207e06e96de28fMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
689023771c563d8660e45d439a207e06e96de28fMark Andrews<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
689023771c563d8660e45d439a207e06e96de28fMark Andrews<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
6bf6622b7b9053dc52527478473b572f042c4b5bMark Andrews<link rel="prev" href="man.dnssec-signzone.html" title="dnssec-signzone">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="man.lwresd.html" title="lwresd">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
cedb0bd0c1e3c461b7e479a16d3adfd5b150f1f4Mark Andrews<table width="100%" summary="Navigation header">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center"><span class="application">dnssec-verify</span></th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="man.lwresd.html">Next</a>
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews<a name="man.dnssec-verify"></a><div class="titlepage"></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein — DNSSEC zone verification tool
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews <p><span class="command"><strong>dnssec-verify</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein verifies that a zone is fully signed for each algorithm found
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein chains are complete.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="variablelist"><dl class="variablelist">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews Specifies the DNS class of the zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specifies the cryptographic hardware to use, when applicable.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When BIND is built with OpenSSL PKCS#11 support, this defaults
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the string "pkcs11", which identifies an OpenSSL engine
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that can drive a cryptographic accelerator or hardware service
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein module. When BIND is built with native PKCS#11 cryptography
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (--enable-native-pkcs11), it defaults to the path of the PKCS#11
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein provider library specified via "--with-pkcs11".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The format of the input zone file.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Possible formats are <span class="command"><strong>"text"</strong></span> (default)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and <span class="command"><strong>"raw"</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This option is primarily intended to be used for dynamic
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews signed zones so that the dumped zone file in a non-text
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein format containing updates can be verified independently.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The use of this option does not make much sense for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein non-dynamic zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The zone origin. If not specified, the name of the zone file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is assumed to be the origin.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Sets the debugging level.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Prints version information.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Only verify that the DNSKEY RRset is signed with key-signing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein keys. Without this flag, it is assumed that the DNSKEY RRset
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews will be signed by all active keys. When this flag is set,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it will not be an error if the DNSKEY RRset is not signed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein by zone-signing keys. This corresponds to the <code class="option">-x</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option in <span class="command"><strong>dnssec-signzone</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Ignore the KSK flag on the keys when determining whether
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the zone if correctly signed. Without this flag it is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein assumed that there will be a non-revoked, self-signed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNSKEY with the KSK flag set for each algorithm and
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews that RRsets other than DNSKEY RRset will be signed with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a different DNSKEY without the KSK flag set.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein With this flag set, we only require that for each algorithm,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein there will be at least one non-revoked, self-signed DNSKEY,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein regardless of the KSK flag state, and that other RRsets
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein will be signed by a non-revoked key for the same algorithm
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that includes the self-signed key; the same key may be used
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for both purposes. This corresponds to the <code class="option">-z</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option in <span class="command"><strong>dnssec-signzone</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The file containing the zone to be signed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="refentrytitle">dnssec-signzone</span>(8)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right">�<a accesskey="n" href="man.lwresd.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<span class="application">dnssec-signzone</span>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right" valign="top">�<span class="application">lwresd</span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.2 (Extended Support Version)</p>