man.rndc.html revision b3338fc248b647e1a88a824a62e809a5b94c076c
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - Copyright (C) 2000-2003 Internet Software Consortium.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - Permission to use, copy, modify, and/or distribute this software for any
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - purpose with or without fee is hereby granted, provided that the above
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - copyright notice and this permission notice appear in all copies.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis - PERFORMANCE OF THIS SOFTWARE.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<link rel="prev" href="man.nsupdate.html" title="nsupdate">
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<link rel="next" href="man.rndc.conf.html" title="rndc.conf">
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<table width="100%" summary="Navigation header">
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<tr><th colspan="3" align="center"><span class="application">rndc</span></th></tr>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<a accesskey="p" href="man.nsupdate.html">Prev</a>�</td>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<th width="60%" align="center">Manual pages</th>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<td width="20%" align="right">�<a accesskey="n" href="man.rndc.conf.html">Next</a>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<a name="man.rndc"></a><div class="titlepage"></div>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<p><span class="application">rndc</span> — name server control utility</p>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<div class="cmdsynopsis"><p><code class="command">rndc</code> [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-q</code>] [<code class="option">-r</code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<p><span><strong class="command">rndc</strong></span>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis controls the operation of a name
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis server. It supersedes the <span><strong class="command">ndc</strong></span> utility
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis that was provided in old BIND releases. If
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc</strong></span> is invoked with no command line
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis options or arguments, it prints a short summary of the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis supported commands and the available options and their
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<p><span><strong class="command">rndc</strong></span>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis communicates with the name server over a TCP connection, sending
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis commands authenticated with digital signatures. In the current
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the only supported authentication algorithms are HMAC-MD5
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis (default), HMAC-SHA384 and HMAC-SHA512.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis They use a shared secret on each end of the connection.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis This provides TSIG-style authentication for the command
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis request and the name server's response. All commands sent
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis over the channel must be signed by a key_id known to the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<p><span><strong class="command">rndc</strong></span>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis reads a configuration file to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis determine how to contact the name server and decide what
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis algorithm and key it should use.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Use <em class="replaceable"><code>source-address</code></em>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis as the source address for the connection to the server.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Multiple instances are permitted to allow setting of both
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the IPv4 and IPv6 source addresses.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Use <em class="replaceable"><code>config-file</code></em>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis as the configuration file instead of the default,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="filename">/etc/rndc.conf</code>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term">-k <em class="replaceable"><code>key-file</code></em></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Use <em class="replaceable"><code>key-file</code></em>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis as the key file instead of the default,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="filename">/etc/rndc.key</code>. The key in
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="filename">/etc/rndc.key</code> will be used to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis commands sent to the server if the <em class="replaceable"><code>config-file</code></em>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis does not exist.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dd><p><em class="replaceable"><code>server</code></em> is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the name or address of the server which matches a
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis server statement in the configuration file for
e440181edb0c182fc57ec12a2dffa371be698ddaAlex Valavanis <span><strong class="command">rndc</strong></span>. If no server is supplied on the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis command line, the host named by the default-server clause
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis in the options statement of the <span><strong class="command">rndc</strong></span>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis configuration file will be used.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Send commands to TCP port
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <em class="replaceable"><code>port</code></em>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis of BIND 9's default control channel port, 953.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Quiet mode: Message text returned by the server
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis will not be printed except when there is an error.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Instructs <span><strong class="command">rndc</strong></span> to print the result code
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis returned by <span><strong class="command">named</strong></span> after executing the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis requested command (e.g., ISC_R_SUCCESS, ISC_R_FAILURE, etc).
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Enable verbose logging.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Use the key <em class="replaceable"><code>key_id</code></em>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis from the configuration file.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <em class="replaceable"><code>key_id</code></em>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis known by <span><strong class="command">named</strong></span> with the same algorithm and secret string
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis in order for control message validation to succeed.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis If no <em class="replaceable"><code>key_id</code></em>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis is specified, <span><strong class="command">rndc</strong></span> will first look
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis for a key clause in the server statement of the server
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis being used, or if no server statement is present for that
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis host, then the default-key clause of the options statement.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Note that the configuration file contains shared secrets
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis which are used to send authenticated control commands
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis to name servers. It should therefore not have general read
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis or write access.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis A list of commands supported by <span><strong class="command">rndc</strong></span> can
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis be seen by running <span><strong class="command">rndc</strong></span> without arguments.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Currently supported commands are:
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>addzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] <em class="replaceable"><code>configuration</code></em> </code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Add a zone while the server is running. This
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis command requires the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">allow-new-zones</strong></span> option to be set
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis to <strong class="userinput"><code>yes</code></strong>. The
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <em class="replaceable"><code>configuration</code></em> string
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis specified on the command line is the zone
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis configuration text that would ordinarily be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis placed in <code class="filename">named.conf</code>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis The configuration is saved in a file called
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="filename"><em class="replaceable"><code>name</code></em>.nzf</code>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis where <em class="replaceable"><code>name</code></em> is the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis name of the view, or if it contains characters
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis that are incompatible with use as a file name, a
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis cryptographic hash generated from the name
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis When <span><strong class="command">named</strong></span> is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis restarted, the file will be loaded into the view
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis configuration, so that zones that were added
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis can persist after a restart.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis This sample <span><strong class="command">addzone</strong></span> command
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis would add the zone <code class="literal">example.com</code>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis to the default view:
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<code class="prompt">$ </code><strong class="userinput"><code>rndc addzone example.com '{ type master; file "example.com.db"; };'</code></strong>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis (Note the brackets and semi-colon around the zone
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis configuration text.)
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis See also <span><strong class="command">rndc delzone</strong></span> and <span><strong class="command">rndc modzone</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>delzone [<span class="optional">-clean</span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Delete a zone while the server is running.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis If the <code class="option">-clean</code> argument is specified,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the zone's master file (and journal file, if any)
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis will be deleted along with the zone. Without the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="option">-clean</code> option, zone files must
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis be cleaned up by hand. (If the zone is of
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis type "slave" or "stub", the files needing to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis be cleaned up will be reported in the output
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis of the <span><strong class="command">rndc delzone</strong></span> command.)
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis If the zone was originally added via
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc addzone</strong></span>, then it will be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis removed permanently. However, if it was originally
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis configured in <code class="filename">named.conf</code>, then
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis that original configuration is still in place; when
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the server is restarted or reconfigured, the zone will
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis come back. To remove it permanently, it must also be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis removed from <code class="filename">named.conf</code>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis See also <span><strong class="command">rndc addzone</strong></span> and <span><strong class="command">rndc modzone</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>dumpdb [<span class="optional">-all|-cache|-zone|-adb|-bad|-fail</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Dump the server's caches (default) and/or zones to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis dump file for the specified views. If no view is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis specified, all
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis views are dumped.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis (See the <span><strong class="command">dump-file</strong></span> option in
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the BIND 9 Administrator Reference Manual.)
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Flushes the server's cache.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Flushes the given name from the view's DNS cache
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis and, if applicable, from the view's nameserver address
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis database, bad server cache and SERVFAIL cache.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Flushes the given name, and all of its subdomains,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis from the view's DNS cache, address database,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis bad server cache, and SERVFAIL cache.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>freeze [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Suspend updates to a dynamic zone. If no zone is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis specified, then all zones are suspended. This allows
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis manual edits to be made to a zone normally updated by
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis dynamic update. It also causes changes in the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis journal file to be synced into the master file.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis All dynamic update attempts will be refused while
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the zone is frozen.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis See also <span><strong class="command">rndc thaw</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Stop the server immediately. Recent changes
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis made through dynamic update or IXFR are not saved to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the master files, but will be rolled forward from the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis journal files when the server is restarted.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis This allows an external process to determine when <span><strong class="command">named</strong></span>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis had completed halting.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis See also <span><strong class="command">rndc stop</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>loadkeys <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Fetch all DNSSEC keys for the given zone
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis from the key directory. If they are within
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis their publication period, merge them into the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis zone's DNSKEY RRset. Unlike <span><strong class="command">rndc
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis sign</strong></span>, however, the zone is not
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis immediately re-signed by the new keys, but is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis allowed to incrementally re-sign over time.
a29c2efdb46401a13ca455bf9d3ab3b4534d5169Alexander Valavanis This command requires that the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">auto-dnssec</strong></span> zone option
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis be set to <code class="literal">maintain</code>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis and also requires the zone to be configured to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis allow dynamic DNS.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis (See "Dynamic Update Policies" in the Administrator
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Reference Manual for more details.)
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>managed-keys <em class="replaceable"><code>(status | refresh | sync)</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis When run with the "status" keyword, print the current
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis status of the managed-keys database for the specified
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis view, or for all views if none is specified. When run
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis with the "refresh" keyword, force an immediate refresh
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis of all the managed-keys in the specified view, or all
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis views. When run with the "sync" keyword, force an
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis immediate dump of the managed-keys database to disk (in
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the file <code class="filename">managed-keys.bind</code> or
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis (<code class="filename"><em class="replaceable"><code>viewname</code></em>.mkeys</code>).
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>modzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] <em class="replaceable"><code>configuration</code></em> </code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Modify the configuration of a zone while the server
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis is running. This command requires the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">allow-new-zones</strong></span> option to be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis set to <strong class="userinput"><code>yes</code></strong>. As with
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">addzone</strong></span>, the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <em class="replaceable"><code>configuration</code></em> string
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis specified on the command line is the zone
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis configuration text that would ordinarily be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis placed in <code class="filename">named.conf</code>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis If the zone was originally added via
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc addzone</strong></span>, the configuration
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis changes will be recorded permanently and will still be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis in effect after the server is restarted or reconfigured.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis However, if it was originally configured in
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="filename">named.conf</code>, then that original
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis configuration is still in place; when the server is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis restarted or reconfigured, the zone will revert to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis its original configuration. To make the changes
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis permanent, it must also be modified in
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis See also <span><strong class="command">rndc addzone</strong></span> and <span><strong class="command">rndc delzone</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Resend NOTIFY messages for the zone.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Sets the server's debugging level to 0.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis See also <span><strong class="command">rndc trace</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>nta
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis [<span class="optional">( -d | -f | -r | -l <em class="replaceable"><code>duration</code></em>)</span>]
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <em class="replaceable"><code>domain</code></em>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis [<span class="optional"><em class="replaceable"><code>view</code></em></span>]
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Sets a DNSSEC negative trust anchor (NTA)
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis for <code class="option">domain</code>, with a lifetime of
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="option">duration</code>. The default lifetime is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis configured in <code class="filename">named.conf</code> via the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="option">nta-lifetime</code> option, and defaults to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis one hour. The lifetime cannot exceed one week.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis A negative trust anchor selectively disables
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis DNSSEC validation for zones that are known to be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis failing because of misconfiguration rather than
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis an attack. When data to be validated is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis at or below an active NTA (and above any other
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis configured trust anchors), <span><strong class="command">named</strong></span> will
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis abort the DNSSEC validation process and treat the data as
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis insecure rather than bogus. This continues until the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis NTA's lifetime is elapsed.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis NTAs persist across restarts of the <span><strong class="command">named</strong></span> server.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis The NTAs for a view are saved in a file called
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="filename"><em class="replaceable"><code>name</code></em>.nta</code>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis where <em class="replaceable"><code>name</code></em> is the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis name of the view, or if it contains characters
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis that are incompatible with use as a file name, a
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis cryptographic hash generated from the name
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis An existing NTA can be removed by using the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis An NTA's lifetime can be specified with the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="option">-lifetime</code> option. TTL-style
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis suffixes can be used to specify the lifetime in
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis seconds, minutes, or hours. If the specified NTA
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis already exists, its lifetime will be updated to the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis new value. Setting <code class="option">lifetime</code> to zero
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis is equivalent to <code class="option">-remove</code>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis If <code class="option">-dump</code> is used, any other arguments
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis are ignored, and a list of existing NTAs is printed
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis (note that this may include NTAs that are expired but
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis have not yet been cleaned up).
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Normally, <span><strong class="command">named</strong></span> will periodically
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis test to see whether data below an NTA can now be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis validated (see the <code class="option">nta-recheck</code> option
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis in the Administrator Reference Manual for details).
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis If data can be validated, then the NTA is regarded as
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis no longer necessary, and will be allowed to expire
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis early. The <code class="option">-force</code> overrides this
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis behavior and forces an NTA to persist for its entire
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis lifetime, regardless of whether data could be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis validated if the NTA were not present.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis All of these options can be shortened, i.e., to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="option">-l</code>, <code class="option">-r</code>, <code class="option">-d</code>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional">on|off</span>] </span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Enable or disable query logging. (For backward
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis compatibility, this command can also be used without
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis an argument to toggle query logging on and off.)
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Query logging can also be enabled
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis by explicitly directing the <span><strong class="command">queries</strong></span>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">category</strong></span> to a
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">channel</strong></span> in the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">logging</strong></span> section of
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="filename">named.conf</code> or by specifying
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">querylog yes;</strong></span> in the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">options</strong></span> section of
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Reload the configuration file and load new zones,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis but do not reload existing zone files even if they
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis have changed.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis This is faster than a full <span><strong class="command">reload</strong></span> when there
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis is a large number of zones because it avoids the need
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis to examine the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis modification times of the zones files.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Dump the list of queries <span><strong class="command">named</strong></span> is currently
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis recursing on, and the list of domains to which iterative
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis queries are currently being sent. (The second list includes
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the number of fetches currently active for the given domain,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis and how many have been passed or dropped because of the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="option">fetches-per-zone</code> option.)
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Schedule zone maintenance for the given zone.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Reload configuration file and zones.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Reload the given zone.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>retransfer <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Retransfer the given slave zone from the master server.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis If the zone is configured to use
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">inline-signing</strong></span>, the signed
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis version of the zone is discarded; after the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis retransfer of the unsigned version is complete, the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis signed version will be regenerated with all new
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>scan</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Scan the list of available network interfaces
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis for changes, without performing a full
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">reconfig</strong></span> or waiting for the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">interface-interval</strong></span> timer.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional">-</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Dump the server's security roots and negative trust anchors
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis for the specified views. If no view is specified, all views
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis If the first argument is "-", then the output is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis returned via the <span><strong class="command">rndc</strong></span> response channel
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis and printed to the standard output.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Otherwise, it is written to the secroots dump file, which
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis defaults to <code class="filename">named.secroots</code>, but can be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis overridden via the <code class="option">secroots-file</code> option in
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis See also <span><strong class="command">rndc managed-keys</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>showzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Print the configuration of a running zone.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis See also <span><strong class="command">rndc zonestatus</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>sign <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Fetch all DNSSEC keys for the given zone
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis from the key directory (see the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">key-directory</strong></span> option in
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the BIND 9 Administrator Reference Manual). If they are within
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis their publication period, merge them into the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis zone's DNSKEY RRset. If the DNSKEY RRset
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis is changed, then the zone is automatically
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis re-signed with the new key set.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis This command requires that the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">auto-dnssec</strong></span> zone option be set
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis and also requires the zone to be configured to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis allow dynamic DNS.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis (See "Dynamic Update Policies" in the Administrator
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Reference Manual for more details.)
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis See also <span><strong class="command">rndc loadkeys</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>signing [<span class="optional">( -list | -clear <em class="replaceable"><code>keyid/algorithm</code></em> | -clear <code class="literal">all</code> | -nsec3param ( <em class="replaceable"><code>parameters</code></em> | <code class="literal">none</code> ) | -serial <em class="replaceable"><code>value</code></em> ) </span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis List, edit, or remove the DNSSEC signing state records
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis for the specified zone. The status of ongoing DNSSEC
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis operations (such as signing or generating
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis NSEC3 chains) is stored in the zone in the form
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis of DNS resource records of type
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">sig-signing-type</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc signing -list</strong></span> converts
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis these records into a human-readable form,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis indicating which keys are currently signing
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis or have finished signing the zone, and which NSEC3
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis chains are being created or removed.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc signing -clear</strong></span> can remove
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis a single key (specified in the same format that
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc signing -list</strong></span> uses to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis display it), or all keys. In either case, only
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis completed keys are removed; any record indicating
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis that a key has not yet finished signing the zone
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis will be retained.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc signing -nsec3param</strong></span> sets
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the NSEC3 parameters for a zone. This is the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis only supported mechanism for using NSEC3 with
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">inline-signing</strong></span> zones.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Parameters are specified in the same format as
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis an NSEC3PARAM resource record: hash algorithm,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis flags, iterations, and salt, in that order.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Currently, the only defined value for hash algorithm
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis is <code class="literal">1</code>, representing SHA-1.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis The <code class="option">flags</code> may be set to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="literal">0</code> or <code class="literal">1</code>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis depending on whether you wish to set the opt-out
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis bit in the NSEC3 chain. <code class="option">iterations</code>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis defines the number of additional times to apply
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the algorithm when generating an NSEC3 hash. The
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="option">salt</code> is a string of data expressed
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis in hexadecimal, a hyphen (`-') if no salt is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis to be used, or the keyword <code class="literal">auto</code>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis which causes <span><strong class="command">named</strong></span> to generate a
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis random 64-bit salt.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis So, for example, to create an NSEC3 chain using
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the SHA-1 hash algorithm, no opt-out flag,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis 10 iterations, and a salt value of "FFFF", use:
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc signing -nsec3param 1 0 10 FFFF <em class="replaceable"><code>zone</code></em></strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis To set the opt-out flag, 15 iterations, and no
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc signing -nsec3param 1 1 15 - <em class="replaceable"><code>zone</code></em></strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc signing -nsec3param none</strong></span>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis removes an existing NSEC3 chain and replaces it
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">rndc signing -serial value</strong></span> sets
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the serial number of the zone to value. If the value
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis would cause the serial number to go backwards it will
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis be rejected. The primary use is to set the serial on
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis inline signed zones.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Write server statistics to the statistics file.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis (See the <span><strong class="command">statistics-file</strong></span> option in
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the BIND 9 Administrator Reference Manual.)
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Display status of the server.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Note that the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis and the default <span><strong class="command">/IN</strong></span>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis hint zone if there is not an
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis explicit root zone configured.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Stop the server, making sure any recent changes
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis made through dynamic update or IXFR are first saved to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the master files of the updated zones.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis This allows an external process to determine when <span><strong class="command">named</strong></span>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis had completed stopping.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<p>See also <span><strong class="command">rndc halt</strong></span>.</p>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>sync [<span class="optional">-clean</span>] [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Sync changes in the journal file for a dynamic zone
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis to the master file. If the "-clean" option is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis specified, the journal file is also removed. If
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis no zone is specified, then all zones are synced.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Enable updates to a frozen dynamic zone. If no
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis zone is specified, then all frozen zones are
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis enabled. This causes the server to reload the zone
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis from disk, and re-enables dynamic updates after the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis load has completed. After a zone is thawed,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis dynamic updates will no longer be refused. If
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis the zone has changed and the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span><strong class="command">ixfr-from-differences</strong></span> option is
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis in use, then the journal file will be updated to
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis reflect changes in the zone. Otherwise, if the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis zone has changed, any existing journal file will be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<p>See also <span><strong class="command">rndc freeze</strong></span>.</p>
413ba5f4c7ae838a0d314a3c5416033b43a65a17Alex Valavanis<dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
413ba5f4c7ae838a0d314a3c5416033b43a65a17Alex Valavanis Increment the servers debugging level by one.
413ba5f4c7ae838a0d314a3c5416033b43a65a17Alex Valavanis<dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
413ba5f4c7ae838a0d314a3c5416033b43a65a17Alex Valavanis Sets the server's debugging level to an explicit
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis See also <span><strong class="command">rndc notrace</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>tsig-delete</code></strong> <em class="replaceable"><code>keyname</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Delete a given TKEY-negotiated key from the server.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis (This does not apply to statically configured TSIG
197a83914b869e636d779ab33d8e3371dc99d71cJon A. Cruz<dt><span class="term"><strong class="userinput"><code>tsig-list</code></strong></span></dt>
197a83914b869e636d779ab33d8e3371dc99d71cJon A. Cruz List the names of all TSIG keys currently configured
197a83914b869e636d779ab33d8e3371dc99d71cJon A. Cruz for use by <span><strong class="command">named</strong></span> in each view. The
197a83914b869e636d779ab33d8e3371dc99d71cJon A. Cruz list both statically configured keys and dynamic
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis TKEY-negotiated keys.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>validation ( on | off | check ) [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>] </code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Enable, disable, or check the current status of
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis DNSSEC validation.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis set to <strong class="userinput"><code>yes</code></strong> or
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <strong class="userinput"><code>auto</code></strong> to be effective.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis It defaults to enabled.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<dt><span class="term"><strong class="userinput"><code>zonestatus <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Displays the current status of the given zone,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis including the master file name and any include
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis files from which it was loaded, when it was most
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis recently loaded, the current serial number, the
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis number of nodes, whether the zone supports
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis dynamic updates, whether the zone is DNSSEC
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis signed, whether it uses automatic DNSSEC key
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis management or inline signing, and the scheduled
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis refresh or expiry times for the zone.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis See also <span><strong class="command">rndc showzone</strong></span>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis There is currently no way to provide the shared secret for a
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <code class="option">key_id</code> without using the configuration file.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis Several error messages could be clearer.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<p><span class="corpauthor">Internet Systems Consortium</span>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<table width="100%" summary="Navigation footer">
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<a accesskey="p" href="man.nsupdate.html">Prev</a>�</td>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<td width="40%" align="right">�<a accesskey="n" href="man.rndc.conf.html">Next</a>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<span class="application">nsupdate</span>�</td>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<td width="40%" align="right" valign="top">�<code class="filename">rndc.conf</code>
65ee9c8a24b30b07b9c03288ccabaa659a490bd4Alex Valavanis<p style="text-align: center;">BIND 9.11.0pre-alpha</p>