man.dnssec-verify.html revision c7f299247ca4460807f44b43f84ba19719646cc9
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest - Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC")
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest - Copyright (C) 2000-2003 Internet Software Consortium.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest - Permission to use, copy, modify, and/or distribute this software for any
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest - purpose with or without fee is hereby granted, provided that the above
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest - copyright notice and this permission notice appear in all copies.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
ca7a323358dc50374d5f281355842fb7edb3983eJames Phillpotts - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest - PERFORMANCE OF THIS SOFTWARE.
f52ca8f9ce43f7765e8c5959e45a667b496526eeAndrew Forrest<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
0fb4093da08d574d3d1b661d4425dfbac8e02aabJames Phillpotts<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
0fb4093da08d574d3d1b661d4425dfbac8e02aabJames Phillpotts<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<link rel="prev" href="man.dnssec-signzone.html" title="dnssec-signzone">
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<link rel="next" href="man.named-checkconf.html" title="named-checkconf">
919ca0cd7bf1dee3c8021e1c80bd699c7a386001Andrew Forrest<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<table width="100%" summary="Navigation header">
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<tr><th colspan="3" align="center"><span class="application">dnssec-verify</span></th></tr>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<th width="60%" align="center">Manual pages</th>
2dd75eff92ef66e22cca286b6f4fe5a9c929af9dPhill Cunnington<td width="20%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<a name="man.dnssec-verify"></a><div class="titlepage"></div>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<p><span class="application">dnssec-verify</span> — DNSSEC zone verification tool</p>
669362f1b4a40a59cfe461728c8765dbdf63159fPhill Cunnington<div class="cmdsynopsis"><p><code class="command">dnssec-verify</code> [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<p><span><strong class="command">dnssec-verify</strong></span>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest verifies that a zone is fully signed for each algorithm found
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
96a86856ac0b95878e74e5ed8d417572493324ceAndrew Forrest chains are complete.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest Specifies the DNS class of the zone.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest The format of the input zone file.
f52ca8f9ce43f7765e8c5959e45a667b496526eeAndrew Forrest Possible formats are <span><strong class="command">"text"</strong></span> (default)
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest and <span><strong class="command">"raw"</strong></span>.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest This option is primarily intended to be used for dynamic
6197cac1b7f675588382db0a6f279614032b5568David Luna signed zones so that the dumped zone file in a non-text
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest format containing updates can be verified independently.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest The use of this option does not make much sense for
919ca0cd7bf1dee3c8021e1c80bd699c7a386001Andrew Forrest non-dynamic zones.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest The zone origin. If not specified, the name of the zone file
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest is assumed to be the origin.
f52ca8f9ce43f7765e8c5959e45a667b496526eeAndrew Forrest<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
ece5a262d20a50d0abf584d0f7ec73929ede9cfdJaco Jooste Sets the debugging level.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest Only verify that the DNSKEY RRset is signed with key-signing
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest keys. Without this flag, it is assumed that the DNSKEY RRset
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest will be signed by all active keys. When this flag is set,
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest it will not be an error if the DNSKEY RRset is not signed
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest by zone-signing keys. This corresponds to the <code class="option">-x</code>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest option in <span><strong class="command">dnssec-signzone</strong></span>.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest Ignore the KSK flag on the keys when determining whether
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest the zone if correctly signed. Without this flag it is
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest assumed that there will be a non-revoked, self-signed
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest DNSKEY with the KSK flag set for each algorithm and
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest that RRsets other than DNSKEY RRset will be signed with
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest a different DNSKEY without the KSK flag set.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest With this flag set, we only require that for each algorithm,
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest there will be at least one non-revoked, self-signed DNSKEY,
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest regardless of the KSK flag state, and that other RRsets
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest will be signed by a non-revoked key for the same algorithm
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest that includes the self-signed key; the same key may be used
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest for both purposes. This corresponds to the <code class="option">-z</code>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest option in <span><strong class="command">dnssec-signzone</strong></span>.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest The file containing the zone to be signed.
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<p><span class="corpauthor">Internet Systems Consortium</span>
96a86856ac0b95878e74e5ed8d417572493324ceAndrew Forrest<table width="100%" summary="Navigation footer">
f52ca8f9ce43f7765e8c5959e45a667b496526eeAndrew Forrest<a accesskey="p" href="man.dnssec-signzone.html">Prev</a>�</td>
864e2a74d7dc5e572cd895466611cc57e3523083Andrew Forrest<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
919ca0cd7bf1dee3c8021e1c80bd699c7a386001Andrew Forrest<td width="40%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a>
919ca0cd7bf1dee3c8021e1c80bd699c7a386001Andrew Forrest<span class="application">dnssec-signzone</span>�</td>
919ca0cd7bf1dee3c8021e1c80bd699c7a386001Andrew Forrest<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
919ca0cd7bf1dee3c8021e1c80bd699c7a386001Andrew Forrest<td width="40%" align="right" valign="top">�<span class="application">named-checkconf</span>