man.dnssec-verify.html revision 892503bd484c106493e3c8053155b364a522ec03
c63ebf815c8a874525cf18670ad74847f7fc7b26Christian Maeder - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
456238178f89e5a3de2988ee6c8af924297d52d9Christian Maeder - Copyright (C) 2000-2003 Internet Software Consortium.
456238178f89e5a3de2988ee6c8af924297d52d9Christian Maeder - Permission to use, copy, modify, and/or distribute this software for any
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - purpose with or without fee is hereby granted, provided that the above
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - copyright notice and this permission notice appear in all copies.
43b4c41fbb07705c9df321221ab9cb9832460407Christian Maeder - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
f4a2a20e49f41b2afa657e5e64d9e349c7faa091Christian Maeder - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
f2f9df2e17e70674f0bf426ed1763c973ee4cde0Christian Maeder - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
c9a7e6af169a2adfb92f42331cd578065ed83a2bChristian Maeder - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
c9a7e6af169a2adfb92f42331cd578065ed83a2bChristian Maeder - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder - PERFORMANCE OF THIS SOFTWARE.
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
b1f59a4ea7c96f4c03a4d7cfcb9c5e66871cfbbbChristian Maeder<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
ad270004874ce1d0697fb30d7309f180553bb315Christian Maeder<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
4d56f2fa72e4aec20eb827c11ed49c8cbb7014bdChristian Maeder<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
4cb215739e9ab13447fa21162482ebe485b47455Christian Maeder<link rel="prev" href="man.dnssec-signzone.html" title="dnssec-signzone">
8ef75f1cc0437656bf622cec5ac9e8ea221da8f2Christian Maeder<link rel="next" href="man.named-checkconf.html" title="named-checkconf">
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder<table width="100%" summary="Navigation header">
3e8b136f23ed57d40ee617f49bcac37830b58cabChristian Maeder<tr><th colspan="3" align="center"><span class="application">dnssec-verify</span></th></tr>
3e8b136f23ed57d40ee617f49bcac37830b58cabChristian Maeder<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
ef9e8535c168d3f774d9e74368a2317a9eda5826Christian Maeder<th width="60%" align="center">Manual pages</th>
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder<td width="20%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a>
f4a2a20e49f41b2afa657e5e64d9e349c7faa091Christian Maeder<a name="man.dnssec-verify"></a><div class="titlepage"></div>
1cd4f6541984962658add5cfaa9f28a93879881bChristian Maeder<p><span class="application">dnssec-verify</span> — DNSSEC zone verification tool</p>
8b767d09a78927b111f5596fdff9ca7d2c1a439fChristian Maeder<div class="cmdsynopsis"><p><code class="command">dnssec-verify</code> [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div>
8b767d09a78927b111f5596fdff9ca7d2c1a439fChristian Maeder<a name="id2635696"></a><h2>DESCRIPTION</h2>
456238178f89e5a3de2988ee6c8af924297d52d9Christian Maeder<p><span><strong class="command">dnssec-verify</strong></span>
d54cd08a4cfa26256c38d8ed12c343adbfe1a0e3Christian Maeder verifies that a zone is fully signed for each algorithm found
23b4e542dca35852f58d1fb3f7d9078c1de5ab06Christian Maeder in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
bab2d88d650448628730ed3b65c9f99c52500e8cChristian Maeder chains are complete.
014dc30f64ec25e4790cca987d4d1e6635430510Christian Maeder<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
6aea82c63ba1d2efc0329bc784a14e521469ec20Christian Maeder Specifies the DNS class of the zone.
feca1d35123d8c31aee238c9ce79947b0bf65494Christian Maeder<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
c8012b9719c73f08418af7a0b4ba28fa1d200631Christian Maeder Specifies the cryptographic hardware to use, when applicable.
6dc9bc98d0854fe2e3dd3bfc4275096a0c28ee1cChristian Maeder When BIND is built with OpenSSL PKCS#11 support, this defaults
6dc9bc98d0854fe2e3dd3bfc4275096a0c28ee1cChristian Maeder to the string "pkcs11", which identifies an OpenSSL engine
23ffcc44ca8612feccbd8fda63fa5be7ab5f9dc3Christian Maeder that can drive a cryptographic accelerator or hardware service
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder module. When BIND is built with native PKCS#11 cryptography
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder (--enable-native-pkcs11), it defaults to the path of the PKCS#11
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder provider library specified via "--with-pkcs11".
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder The format of the input zone file.
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder Possible formats are <span><strong class="command">"text"</strong></span> (default)
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder and <span><strong class="command">"raw"</strong></span>.
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder This option is primarily intended to be used for dynamic
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder signed zones so that the dumped zone file in a non-text
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder format containing updates can be verified independently.
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder The use of this option does not make much sense for
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder non-dynamic zones.
bc8cbf12aa172bf5673b92a9e7a0151d4aa4c315Christian Maeder<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
2d130d212db7208777ca896a7ecad619a8944971Christian Maeder The zone origin. If not specified, the name of the zone file
51d769d55d88dfa88bdf54bee78d8fa85a2deba8Christian Maeder is assumed to be the origin.
a42fbfe7becf0eae2d624123eb0db73a794593f0Christian Maeder<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
b363eb04791e7f735633b9b4088502c2bc50ebfcChristian Maeder Sets the debugging level.
2d130d212db7208777ca896a7ecad619a8944971Christian Maeder Only verify that the DNSKEY RRset is signed with key-signing
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder keys. Without this flag, it is assumed that the DNSKEY RRset
6ff7a91875597d6e4dfaa68c79187d01473e8341Christian Maeder will be signed by all active keys. When this flag is set,
6ff7a91875597d6e4dfaa68c79187d01473e8341Christian Maeder it will not be an error if the DNSKEY RRset is not signed
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder by zone-signing keys. This corresponds to the <code class="option">-x</code>
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder option in <span><strong class="command">dnssec-signzone</strong></span>.
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder Ignore the KSK flag on the keys when determining whether
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder the zone if correctly signed. Without this flag it is
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder assumed that there will be a non-revoked, self-signed
a3c6d8e0670bf2aa71bc8e2a3b1f45d56dd65e4cChristian Maeder DNSKEY with the KSK flag set for each algorithm and
dc679edd4ca027663212afdf00926ae2ce19b555Christian Maeder that RRsets other than DNSKEY RRset will be signed with
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder a different DNSKEY without the KSK flag set.
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder With this flag set, we only require that for each algorithm,
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder there will be at least one non-revoked, self-signed DNSKEY,
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder regardless of the KSK flag state, and that other RRsets
4017ebc0f692820736d796af3110c3b3018c108aChristian Maeder will be signed by a non-revoked key for the same algorithm
b568982efd0997d877286faa592d81b03c8c67b8Christian Maeder that includes the self-signed key; the same key may be used
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder for both purposes. This corresponds to the <code class="option">-z</code>
0be0db405c49906bd7057255069bf6df53395ac9Klaus Luettich option in <span><strong class="command">dnssec-signzone</strong></span>.
f2f9df2e17e70674f0bf426ed1763c973ee4cde0Christian Maeder The file containing the zone to be signed.
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder<p><span class="corpauthor">Internet Systems Consortium</span>
d946c1bfdd7d58aa7c023efe864d5999eb44a61bChristian Maeder<table width="100%" summary="Navigation footer">
e4f4d096e5e6d60dd91c746d0e833d0ac7a29c50Christian Maeder<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
eb74267cf39e4e95f9eeb5c765f4c8dac33971b4Christian Maeder<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
eb74267cf39e4e95f9eeb5c765f4c8dac33971b4Christian Maeder<td width="40%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a>
8d178ae08a52d61379e6b8074f61646499bc88bbChristian Maeder<span class="application">dnssec-signzone</span>�</td>
456238178f89e5a3de2988ee6c8af924297d52d9Christian Maeder<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
6cd33d6101fb1b93baa6d86fac158af18a115108Christian Maeder<td width="40%" align="right" valign="top">�<span class="application">named-checkconf</span>