man.dnssec-verify.html revision 903596730995d4a0a7c3cc76119c9cf240a4c4fc
080575042aba2197b425ebfd52061dea061a9aa1xy<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
080575042aba2197b425ebfd52061dea061a9aa1xy - Copyright (C) 2000-2015 Internet Systems Consortium, Inc. ("ISC")
080575042aba2197b425ebfd52061dea061a9aa1xy - This Source Code Form is subject to the terms of the Mozilla Public
080575042aba2197b425ebfd52061dea061a9aa1xy - License, v. 2.0. If a copy of the MPL was not distributed with this
080575042aba2197b425ebfd52061dea061a9aa1xy - file, You can obtain one at http://mozilla.org/MPL/2.0/.
d5c3073dbbd835e1e9b7dca0c6c770cf3cc20afachenlu chen - Sun Microsystems - Beijing China<html lang="en">
080575042aba2197b425ebfd52061dea061a9aa1xy<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
080575042aba2197b425ebfd52061dea061a9aa1xy<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
080575042aba2197b425ebfd52061dea061a9aa1xy<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
080575042aba2197b425ebfd52061dea061a9aa1xy<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
080575042aba2197b425ebfd52061dea061a9aa1xy<link rel="prev" href="man.dnssec-signzone.html" title="dnssec-signzone">
080575042aba2197b425ebfd52061dea061a9aa1xy<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
3f64cd552fee350c8075ec62765e9a6f9caef1a8guoqing zhu - Sun Microsystems - Beijing China<tr><th colspan="3" align="center"><span class="application">dnssec-verify</span></th></tr>
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
080575042aba2197b425ebfd52061dea061a9aa1xy<td width="20%" align="right">�<a accesskey="n" href="man.lwresd.html">Next</a>
080575042aba2197b425ebfd52061dea061a9aa1xy<a name="man.dnssec-verify"></a><div class="titlepage"></div>
080575042aba2197b425ebfd52061dea061a9aa1xy<p><span class="application">dnssec-verify</span> — DNSSEC zone verification tool</p>
080575042aba2197b425ebfd52061dea061a9aa1xy<div class="cmdsynopsis"><p><code class="command">dnssec-verify</code> [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div>
080575042aba2197b425ebfd52061dea061a9aa1xy<p><span class="command"><strong>dnssec-verify</strong></span>
080575042aba2197b425ebfd52061dea061a9aa1xy verifies that a zone is fully signed for each algorithm found
080575042aba2197b425ebfd52061dea061a9aa1xy in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
080575042aba2197b425ebfd52061dea061a9aa1xy chains are complete.
080575042aba2197b425ebfd52061dea061a9aa1xy<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
c124a83e09115de88ecccd4f689983f42a1d53bdRobert Mustacchi Specifies the DNS class of the zone.
4d7379630d53d9992780329b674af8c85935e858xiangtao you - Sun Microsystems - Beijing China<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
25f2d433de915875c8393f0b0dc14aa155997ad0xy Specifies the cryptographic hardware to use, when applicable.
25f2d433de915875c8393f0b0dc14aa155997ad0xy When BIND is built with OpenSSL PKCS#11 support, this defaults
25f2d433de915875c8393f0b0dc14aa155997ad0xy to the string "pkcs11", which identifies an OpenSSL engine
25f2d433de915875c8393f0b0dc14aa155997ad0xy that can drive a cryptographic accelerator or hardware service
25f2d433de915875c8393f0b0dc14aa155997ad0xy module. When BIND is built with native PKCS#11 cryptography
25f2d433de915875c8393f0b0dc14aa155997ad0xy (--enable-native-pkcs11), it defaults to the path of the PKCS#11
25f2d433de915875c8393f0b0dc14aa155997ad0xy provider library specified via "--with-pkcs11".
080575042aba2197b425ebfd52061dea061a9aa1xy<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
080575042aba2197b425ebfd52061dea061a9aa1xy The format of the input zone file.
080575042aba2197b425ebfd52061dea061a9aa1xy Possible formats are <span class="command"><strong>"text"</strong></span> (default)
080575042aba2197b425ebfd52061dea061a9aa1xy This option is primarily intended to be used for dynamic
080575042aba2197b425ebfd52061dea061a9aa1xy signed zones so that the dumped zone file in a non-text
25f2d433de915875c8393f0b0dc14aa155997ad0xy format containing updates can be verified independently.
080575042aba2197b425ebfd52061dea061a9aa1xy The use of this option does not make much sense for
4d7379630d53d9992780329b674af8c85935e858xiangtao you - Sun Microsystems - Beijing China non-dynamic zones.
75eba5b6d79ed4d2ce3daf7b2806306b6b69a938Robert Mustacchi<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
caf05df5c10c960028f122b1b02a3f7d8f892c31Miles Xu, Sun Microsystems The zone origin. If not specified, the name of the zone file
080575042aba2197b425ebfd52061dea061a9aa1xy is assumed to be the origin.
25f2d433de915875c8393f0b0dc14aa155997ad0xy<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
25f2d433de915875c8393f0b0dc14aa155997ad0xy Sets the debugging level.
ede5269ebe7fa3787cc9b58c3781b639c578f93dchenlu chen - Sun Microsystems - Beijing China Prints version information.
25f2d433de915875c8393f0b0dc14aa155997ad0xy Only verify that the DNSKEY RRset is signed with key-signing
25f2d433de915875c8393f0b0dc14aa155997ad0xy keys. Without this flag, it is assumed that the DNSKEY RRset
25f2d433de915875c8393f0b0dc14aa155997ad0xy will be signed by all active keys. When this flag is set,
25f2d433de915875c8393f0b0dc14aa155997ad0xy it will not be an error if the DNSKEY RRset is not signed
25f2d433de915875c8393f0b0dc14aa155997ad0xy by zone-signing keys. This corresponds to the <code class="option">-x</code>
592a4d85662412bade15f3d9e9e0cbcf8514348ccc option in <span class="command"><strong>dnssec-signzone</strong></span>.
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi Ignore the KSK flag on the keys when determining whether
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi the zone if correctly signed. Without this flag it is
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi assumed that there will be a non-revoked, self-signed
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi DNSKEY with the KSK flag set for each algorithm and
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi that RRsets other than DNSKEY RRset will be signed with
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi a different DNSKEY without the KSK flag set.
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi With this flag set, we only require that for each algorithm,
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi there will be at least one non-revoked, self-signed DNSKEY,
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi regardless of the KSK flag state, and that other RRsets
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi will be signed by a non-revoked key for the same algorithm
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi that includes the self-signed key; the same key may be used
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi for both purposes. This corresponds to the <code class="option">-z</code>
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi option in <span class="command"><strong>dnssec-signzone</strong></span>.
fe62dec3a38f1f79ffe68417df75dbbb58135bb7Chen-Liang Xu The file containing the zone to be signed.
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
080575042aba2197b425ebfd52061dea061a9aa1xy <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
49b7860084dbba18bc00b29413d6182197f9fe93Robert Mustacchi<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
25f2d433de915875c8393f0b0dc14aa155997ad0xy<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
25f2d433de915875c8393f0b0dc14aa155997ad0xy<td width="40%" align="right">�<a accesskey="n" href="man.lwresd.html">Next</a>
fe62dec3a38f1f79ffe68417df75dbbb58135bb7Chen-Liang Xu<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
25f2d433de915875c8393f0b0dc14aa155997ad0xy<td width="40%" align="right" valign="top">�<span class="application">lwresd</span>
25f2d433de915875c8393f0b0dc14aa155997ad0xy<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.0rc2</p>