man.dnssec-verify.html revision ab3bdbd2ee61b06fa1dc4d3adbcff46cd808185a
ea1a228c80597366447774aa1988868492330eb5schwartz - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
ea1a228c80597366447774aa1988868492330eb5schwartz - Copyright (C) 2000-2003 Internet Software Consortium.
ea1a228c80597366447774aa1988868492330eb5schwartz - Permission to use, copy, modify, and/or distribute this software for any
ea1a228c80597366447774aa1988868492330eb5schwartz - purpose with or without fee is hereby granted, provided that the above
ea1a228c80597366447774aa1988868492330eb5schwartz - copyright notice and this permission notice appear in all copies.
ea1a228c80597366447774aa1988868492330eb5schwartz - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
ea1a228c80597366447774aa1988868492330eb5schwartz - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
ea1a228c80597366447774aa1988868492330eb5schwartz - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
ea1a228c80597366447774aa1988868492330eb5schwartz - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
ea1a228c80597366447774aa1988868492330eb5schwartz - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
ea1a228c80597366447774aa1988868492330eb5schwartz - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
ea1a228c80597366447774aa1988868492330eb5schwartz - PERFORMANCE OF THIS SOFTWARE.
ea1a228c80597366447774aa1988868492330eb5schwartz<!-- $Id$ -->
ea1a228c80597366447774aa1988868492330eb5schwartz<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
ea1a228c80597366447774aa1988868492330eb5schwartz<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
ea1a228c80597366447774aa1988868492330eb5schwartz<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
ea1a228c80597366447774aa1988868492330eb5schwartz<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
ea1a228c80597366447774aa1988868492330eb5schwartz<link rel="prev" href="man.dnssec-signzone.html" title="dnssec-signzone">
ea1a228c80597366447774aa1988868492330eb5schwartz<link rel="next" href="man.named-checkconf.html" title="named-checkconf">
ea1a228c80597366447774aa1988868492330eb5schwartz<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
ea1a228c80597366447774aa1988868492330eb5schwartz<tr><th colspan="3" align="center"><span class="application">dnssec-verify</span></th></tr>
ea1a228c80597366447774aa1988868492330eb5schwartz<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
ea1a228c80597366447774aa1988868492330eb5schwartz<td width="20%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a>
ea1a228c80597366447774aa1988868492330eb5schwartz<a name="man.dnssec-verify"></a><div class="titlepage"></div>
ea1a228c80597366447774aa1988868492330eb5schwartz<p><span class="application">dnssec-verify</span> — DNSSEC zone verification tool</p>
ea1a228c80597366447774aa1988868492330eb5schwartz<div class="cmdsynopsis"><p><code class="command">dnssec-verify</code> [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div>
ea1a228c80597366447774aa1988868492330eb5schwartz<p><span><strong class="command">dnssec-verify</strong></span>
ea1a228c80597366447774aa1988868492330eb5schwartz verifies that a zone is fully signed for each algorithm found
ea1a228c80597366447774aa1988868492330eb5schwartz in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
ea1a228c80597366447774aa1988868492330eb5schwartz chains are complete.
ea1a228c80597366447774aa1988868492330eb5schwartz<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
ea1a228c80597366447774aa1988868492330eb5schwartz Specifies the DNS class of the zone.
ea1a228c80597366447774aa1988868492330eb5schwartz<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
ea1a228c80597366447774aa1988868492330eb5schwartz Specifies the cryptographic hardware to use, when applicable.
ea1a228c80597366447774aa1988868492330eb5schwartz When BIND is built with OpenSSL PKCS#11 support, this defaults
ea1a228c80597366447774aa1988868492330eb5schwartz to the string "pkcs11", which identifies an OpenSSL engine
ea1a228c80597366447774aa1988868492330eb5schwartz that can drive a cryptographic accelerator or hardware service
ea1a228c80597366447774aa1988868492330eb5schwartz module. When BIND is built with native PKCS#11 cryptography
ea1a228c80597366447774aa1988868492330eb5schwartz (--enable-native-pkcs11), it defaults to the path of the PKCS#11
ea1a228c80597366447774aa1988868492330eb5schwartz provider library specified via "--with-pkcs11".
ea1a228c80597366447774aa1988868492330eb5schwartz<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
ea1a228c80597366447774aa1988868492330eb5schwartz The format of the input zone file.
ea1a228c80597366447774aa1988868492330eb5schwartz Possible formats are <span><strong class="command">"text"</strong></span> (default)
ea1a228c80597366447774aa1988868492330eb5schwartz and <span><strong class="command">"raw"</strong></span>.
ea1a228c80597366447774aa1988868492330eb5schwartz This option is primarily intended to be used for dynamic
ea1a228c80597366447774aa1988868492330eb5schwartz signed zones so that the dumped zone file in a non-text
ea1a228c80597366447774aa1988868492330eb5schwartz format containing updates can be verified independently.
ea1a228c80597366447774aa1988868492330eb5schwartz The use of this option does not make much sense for
ea1a228c80597366447774aa1988868492330eb5schwartz non-dynamic zones.
ea1a228c80597366447774aa1988868492330eb5schwartz<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
ea1a228c80597366447774aa1988868492330eb5schwartz The zone origin. If not specified, the name of the zone file
ea1a228c80597366447774aa1988868492330eb5schwartz is assumed to be the origin.
ea1a228c80597366447774aa1988868492330eb5schwartz<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
ea1a228c80597366447774aa1988868492330eb5schwartz Sets the debugging level.