man.rndc.html revision 04bbadfbcb8a755cb208c4034073a3c0eb96b9aa
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<!--
990d0e893f5b70e735cdf990af66e9ec6e91fa78Tinderbox User - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews -
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - Permission to use, copy, modify, and/or distribute this software for any
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - purpose with or without fee is hereby granted, provided that the above
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - copyright notice and this permission notice appear in all copies.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews -
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews-->
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User<!-- $Id$ -->
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<html>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<head>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<title>rndc</title>
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<link rel="prev" href="man.nsupdate.html" title="nsupdate">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<link rel="next" href="man.rndc.conf.html" title="rndc.conf">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</head>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="navheader">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<table width="100%" summary="Navigation header">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<tr><th colspan="3" align="center"><span class="application">rndc</span></th></tr>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<tr>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<td width="20%" align="left">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a accesskey="p" href="man.nsupdate.html">Prev</a>�</td>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<th width="60%" align="center">Manual pages</th>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<td width="20%" align="right">�<a accesskey="n" href="man.rndc.conf.html">Next</a>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</td>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</tr>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</table>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<hr>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="refentry" lang="en">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a name="man.rndc"></a><div class="titlepage"></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="refnamediv">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<h2>Name</h2>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p><span class="application">rndc</span> &#8212; name server control utility</p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="refsynopsisdiv">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<h2>Synopsis</h2>
b46346eb3026ba4bebc093bc93cfe159131e541eTinderbox User<div class="cmdsynopsis"><p><code class="command">rndc</code> [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="refsect1" lang="en">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a name="id2644724"></a><h2>DESCRIPTION</h2>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p><span><strong class="command">rndc</strong></span>
d9f0b06dc2bba47e3fe63afdf41c638d3517ceffTinderbox User controls the operation of a name
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews server. It supersedes the <span><strong class="command">ndc</strong></span> utility
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews that was provided in old BIND releases. If
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span><strong class="command">rndc</strong></span> is invoked with no command line
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews options or arguments, it prints a short summary of the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews supported commands and the available options and their
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews arguments.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p><span><strong class="command">rndc</strong></span>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews communicates with the name server over a TCP connection, sending
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews commands authenticated with digital signatures. In the current
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews versions of
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the only supported authentication algorithms are HMAC-MD5
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews (default), HMAC-SHA384 and HMAC-SHA512.
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews They use a shared secret on each end of the connection.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews This provides TSIG-style authentication for the command
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews request and the name server's response. All commands sent
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews over the channel must be signed by a key_id known to the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews server.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p><span><strong class="command">rndc</strong></span>
d8620c7234281056fdfd2ee40cf16636b8281092Tinderbox User reads a configuration file to
03c0efc6892ef2ed17338b2ecbb2c5f23fbad0c9Tinderbox User determine how to contact the name server and decide what
d8620c7234281056fdfd2ee40cf16636b8281092Tinderbox User algorithm and key it should use.
d8620c7234281056fdfd2ee40cf16636b8281092Tinderbox User </p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="refsect1" lang="en">
b49958b502ee45022010a0b1bed3968f598895a4Automatic Updater<a name="id2644774"></a><h2>OPTIONS</h2>
b49958b502ee45022010a0b1bed3968f598895a4Automatic Updater<div class="variablelist"><dl>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Use <em class="replaceable"><code>source-address</code></em>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews as the source address for the connection to the server.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Multiple instances are permitted to allow setting of both
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the IPv4 and IPv6 source addresses.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p></dd>
b3cbb2f1ad021349e89807f3492df6e4e679cd56Mark Andrews<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
b3cbb2f1ad021349e89807f3492df6e4e679cd56Mark Andrews<dd><p>
665a24faf6b3711e4012ac02ae5f0981c093ac1eTinderbox User Use <em class="replaceable"><code>config-file</code></em>
b49958b502ee45022010a0b1bed3968f598895a4Automatic Updater as the configuration file instead of the default,
b49958b502ee45022010a0b1bed3968f598895a4Automatic Updater <code class="filename">/etc/rndc.conf</code>.
b3cbb2f1ad021349e89807f3492df6e4e679cd56Mark Andrews </p></dd>
b3cbb2f1ad021349e89807f3492df6e4e679cd56Mark Andrews<dt><span class="term">-k <em class="replaceable"><code>key-file</code></em></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Use <em class="replaceable"><code>key-file</code></em>
d9f0b06dc2bba47e3fe63afdf41c638d3517ceffTinderbox User as the key file instead of the default,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <code class="filename">/etc/rndc.key</code>. The key in
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <code class="filename">/etc/rndc.key</code> will be used to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews authenticate
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews commands sent to the server if the <em class="replaceable"><code>config-file</code></em>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews does not exist.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p></dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p><em class="replaceable"><code>server</code></em> is
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the name or address of the server which matches a
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews server statement in the configuration file for
d8620c7234281056fdfd2ee40cf16636b8281092Tinderbox User <span><strong class="command">rndc</strong></span>. If no server is supplied on the
d8620c7234281056fdfd2ee40cf16636b8281092Tinderbox User command line, the host named by the default-server clause
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User in the options statement of the <span><strong class="command">rndc</strong></span>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User configuration file will be used.
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User </p></dd>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User<dd><p>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User Send commands to TCP port
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User <em class="replaceable"><code>port</code></em>
d8620c7234281056fdfd2ee40cf16636b8281092Tinderbox User instead
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User of BIND 9's default control channel port, 953.
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User </p></dd>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User<dt><span class="term">-V</span></dt>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User<dd><p>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User Enable verbose logging.
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User </p></dd>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User<dd><p>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User Use the key <em class="replaceable"><code>key_id</code></em>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User from the configuration file.
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User <em class="replaceable"><code>key_id</code></em>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User must be
d8620c7234281056fdfd2ee40cf16636b8281092Tinderbox User known by named with the same algorithm and secret string
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews in order for control message validation to succeed.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews If no <em class="replaceable"><code>key_id</code></em>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User is specified, <span><strong class="command">rndc</strong></span> will first look
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User for a key clause in the server statement of the server
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews being used, or if no server statement is present for that
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews host, then the default-key clause of the options statement.
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User Note that the configuration file contains shared secrets
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User which are used to send authenticated control commands
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User to name servers. It should therefore not have general read
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User or write access.
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User </p></dd>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User</dl></div>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User</div>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User<div class="refsect1" lang="en">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a name="id2645120"></a><h2>COMMANDS</h2>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews A list of commands supported by <span><strong class="command">rndc</strong></span> can
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews be seen by running <span><strong class="command">rndc</strong></span> without arguments.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
d9f0b06dc2bba47e3fe63afdf41c638d3517ceffTinderbox User<p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Currently supported commands are:
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="variablelist"><dl>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Reload configuration file and zones.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p></dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Reload the given zone.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p></dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews<dd><p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Schedule zone maintenance for the given zone.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p></dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>retransfer <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Retransfer the given slave zone from the master server.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews<p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews If the zone is configured to use
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span><strong class="command">inline-signing</strong></span>, the signed
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews version of the zone is discarded; after the
1c09d68dfd18b6e839c8cd68b78c11b3ccca4160Automatic Updater retransfer of the unsigned version is complete, the
1c09d68dfd18b6e839c8cd68b78c11b3ccca4160Automatic Updater signed version will be regenerated with all new
1c09d68dfd18b6e839c8cd68b78c11b3ccca4160Automatic Updater signatures.
1c09d68dfd18b6e839c8cd68b78c11b3ccca4160Automatic Updater </p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>sign <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Fetch all DNSSEC keys for the given zone
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews from the key directory (see the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span><strong class="command">key-directory</strong></span> option in
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the BIND 9 Administrator Reference Manual). If they are within
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews their publication period, merge them into the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews zone's DNSKEY RRset. If the DNSKEY RRset
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews is changed, then the zone is automatically
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews re-signed with the new key set.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews This command requires that the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span><strong class="command">auto-dnssec</strong></span> zone option be set
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews to <code class="literal">allow</code> or
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <code class="literal">maintain</code>,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews and also requires the zone to be configured to
f6da30bb5447c23d880b09f601441e70c5313557Mark Andrews allow dynamic DNS.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews (See "Dynamic Update Policies" in the Administrator
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Reference Manual for more details.)
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>loadkeys <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Fetch all DNSSEC keys for the given zone
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews from the key directory. If they are within
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews their publication period, merge them into the
665a24faf6b3711e4012ac02ae5f0981c093ac1eTinderbox User zone's DNSKEY RRset. Unlike <span><strong class="command">rndc
8c9957e63274e6ea44d182703116307b1a65dabbMark Andrews sign</strong></span>, however, the zone is not
a057e8e33baa5fa369be28a9680585200ce3ff73Mark Andrews immediately re-signed by the new keys, but is
b46346eb3026ba4bebc093bc93cfe159131e541eTinderbox User allowed to incrementally re-sign over time.
b46346eb3026ba4bebc093bc93cfe159131e541eTinderbox User </p>
b46346eb3026ba4bebc093bc93cfe159131e541eTinderbox User<p>
b46346eb3026ba4bebc093bc93cfe159131e541eTinderbox User This command requires that the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span><strong class="command">auto-dnssec</strong></span> zone option
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews be set to <code class="literal">maintain</code>,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews and also requires the zone to be configured to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews allow dynamic DNS.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews (See "Dynamic Update Policies" in the Administrator
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Reference Manual for more details.)
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>freeze [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Suspend updates to a dynamic zone. If no zone is
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews specified, then all zones are suspended. This allows
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews manual edits to be made to a zone normally updated by
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews dynamic update. It also causes changes in the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews journal file to be synced into the master file.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews All dynamic update attempts will be refused while
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the zone is frozen.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p></dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Enable updates to a frozen dynamic zone. If no
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews zone is specified, then all frozen zones are
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews enabled. This causes the server to reload the zone
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews from disk, and re-enables dynamic updates after the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews load has completed. After a zone is thawed,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews dynamic updates will no longer be refused. If
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the zone has changed and the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span><strong class="command">ixfr-from-differences</strong></span> option is
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews in use, then the journal file will be updated to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews reflect changes in the zone. Otherwise, if the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews zone has changed, any existing journal file will be
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews removed.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p></dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>sync [<span class="optional">-clean</span>] [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Sync changes in the journal file for a dynamic zone
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews to the master file. If the "-clean" option is
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews specified, the journal file is also removed. If
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews no zone is specified, then all zones are synced.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p></dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
d9f0b06dc2bba47e3fe63afdf41c638d3517ceffTinderbox User Resend NOTIFY messages for the zone.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p></dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Reload the configuration file and load new zones,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews but do not reload existing zone files even if they
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews have changed.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews This is faster than a full <span><strong class="command">reload</strong></span> when there
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews is a large number of zones because it avoids the need
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews to examine the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews modification times of the zones files.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p></dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>zonestatus [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Displays the current status of the given zone,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews including the master file name and any include
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews files from which it was loaded, when it was most
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews recently loaded, the current serial number, the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews number of nodes, whether the zone supports
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews dynamic updates, whether the zone is DNSSEC
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User signed, whether it uses automatic DNSSEC key
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews management or inline signing, and the scheduled
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User refresh or expiry times for the zone.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Write server statistics to the statistics file.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional">on|off</span>] </span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Enable or disable query logging. (For backward
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User compatibility, this command can also be used without
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews an argument to toggle query logging on and off.)
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
370c55dfcdc559b8761ef3eb4921498580caf14cAutomatic Updater<p>
370c55dfcdc559b8761ef3eb4921498580caf14cAutomatic Updater Query logging can also be enabled
370c55dfcdc559b8761ef3eb4921498580caf14cAutomatic Updater by explicitly directing the <span><strong class="command">queries</strong></span>
370c55dfcdc559b8761ef3eb4921498580caf14cAutomatic Updater <span><strong class="command">category</strong></span> to a
370c55dfcdc559b8761ef3eb4921498580caf14cAutomatic Updater <span><strong class="command">channel</strong></span> in the
370c55dfcdc559b8761ef3eb4921498580caf14cAutomatic Updater <span><strong class="command">logging</strong></span> section of
370c55dfcdc559b8761ef3eb4921498580caf14cAutomatic Updater <code class="filename">named.conf</code> or by specifying
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater <span><strong class="command">querylog yes;</strong></span> in the
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater <span><strong class="command">options</strong></span> section of
370c55dfcdc559b8761ef3eb4921498580caf14cAutomatic Updater <code class="filename">named.conf</code>.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>dumpdb [<span class="optional">-all|-cache|-zone</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Dump the server's caches (default) and/or zones to
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User the
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User dump file for the specified views. If no view is
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User specified, all
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User views are dumped.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Dump the server's security roots to the secroots
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User file for the specified views. If no view is
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User specified, security roots for all
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User views are dumped.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Stop the server, making sure any recent changes
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User made through dynamic update or IXFR are first saved to
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User the master files of the updated zones.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User This allows an external process to determine when <span><strong class="command">named</strong></span>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User had completed stopping.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Stop the server immediately. Recent changes
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews made through dynamic update or IXFR are not saved to
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the master files, but will be rolled forward from the
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User journal files when the server is restarted.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User This allows an external process to determine when <span><strong class="command">named</strong></span>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User had completed halting.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p></dd>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Increment the servers debugging level by one.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Sets the server's debugging level to an explicit
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User value.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Sets the server's debugging level to 0.
e68c527dff2f1f7df2a542f8d6f9181a27e05eb7Tinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Flushes the server's cache.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Flushes the given name from the server's DNS cache
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User and, if applicable, from the server's nameserver address
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User database or bad-server cache.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> [<span class="optional">-all</span>] <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Flushes the given name, and all of its subdomains,
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User from the server's DNS cache, the address database,
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User and the bad server cache.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Display status of the server.
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User Note that the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User and the default <span><strong class="command">/IN</strong></span>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User hint zone if there is not an
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User explicit root zone configured.
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User </p></dd>
6bcac4b58d16ee91184a72bd4ff05c41538fd932Tinderbox User<dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Dump the list of queries <span><strong class="command">named</strong></span> is currently recursing
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User on.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>validation ( on | off | check ) [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>] </code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Enable, disable, or check the current status of
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User DNSSEC validation.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
d9f0b06dc2bba47e3fe63afdf41c638d3517ceffTinderbox User set to <strong class="userinput"><code>yes</code></strong> or
d9f0b06dc2bba47e3fe63afdf41c638d3517ceffTinderbox User <strong class="userinput"><code>auto</code></strong> to be effective.
d9f0b06dc2bba47e3fe63afdf41c638d3517ceffTinderbox User It defaults to enabled.
d9f0b06dc2bba47e3fe63afdf41c638d3517ceffTinderbox User </p></dd>
d9f0b06dc2bba47e3fe63afdf41c638d3517ceffTinderbox User<dt><span class="term"><strong class="userinput"><code>tsig-list</code></strong></span></dt>
d9f0b06dc2bba47e3fe63afdf41c638d3517ceffTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User List the names of all TSIG keys currently configured
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User for use by <span><strong class="command">named</strong></span> in each view. The
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User list both statically configured keys and dynamic
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User TKEY-negotiated keys.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>tsig-delete</code></strong> <em class="replaceable"><code>keyname</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd><p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Delete a given TKEY-negotiated key from the server.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User (This does not apply to statically configured TSIG
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User keys.)
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p></dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>addzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] <em class="replaceable"><code>configuration</code></em> </code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd>
b90c4f0646e61b6cc82bde5a93e400e1015974b8Tinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Add a zone while the server is running. This
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User command requires the
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span><strong class="command">allow-new-zones</strong></span> option to be set
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User to <strong class="userinput"><code>yes</code></strong>. The
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <em class="replaceable"><code>configuration</code></em> string
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User specified on the command line is the zone
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User configuration text that would ordinarily be
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User placed in <code class="filename">named.conf</code>.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User The configuration is saved in a file called
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <code class="filename"><em class="replaceable"><code>hash</code></em>.nzf</code>,
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User where <em class="replaceable"><code>hash</code></em> is a
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User cryptographic hash generated from the name of
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User the view. When <span><strong class="command">named</strong></span> is
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User restarted, the file will be loaded into the view
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User configuration, so that zones that were added
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User can persist after a restart.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User This sample <span><strong class="command">addzone</strong></span> command
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User would add the zone <code class="literal">example.com</code>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User to the default view:
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<code class="prompt">$ </code><strong class="userinput"><code>rndc addzone example.com '{ type master; file "example.com.db"; };'</code></strong>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User (Note the brackets and semi-colon around the zone
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User configuration text.)
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>delzone [<span class="optional">-clean</span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Delete a zone while the server is running.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Only zones that were originally added via
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span><strong class="command">rndc addzone</strong></span> can be deleted
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User in this manner.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User If the <code class="option">-clean</code> is specified,
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User the zone's master file (and journal file, if any)
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User will be deleted along with the zone. Without the
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <code class="option">-clean</code> option, zone files must
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User be cleaned up by hand. (If the zone is of
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User type "slave" or "stub", the files needing to
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User be cleaned up will be reported in the output
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User of the <span><strong class="command">rndc delzone</strong></span> command.)
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dt><span class="term"><strong class="userinput"><code>signing [<span class="optional">( -list | -clear <em class="replaceable"><code>keyid/algorithm</code></em> | -clear <code class="literal">all</code> | -nsec3param ( <em class="replaceable"><code>parameters</code></em> | <code class="literal">none</code> ) ) </span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User List, edit, or remove the DNSSEC signing state for
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User the specified zone. The status of ongoing DNSSEC
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User operations (such as signing or generating
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User NSEC3 chains) is stored in the zone in the form
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User of DNS resource records of type
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span><strong class="command">sig-signing-type</strong></span>.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span><strong class="command">rndc signing -list</strong></span> converts
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User these records into a human-readable form,
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User indicating which keys are currently signing
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User or have finished signing the zone, and which NSEC3
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User chains are being created or removed.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span><strong class="command">rndc signing -clear</strong></span> can remove
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User a single key (specified in the same format that
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span><strong class="command">rndc signing -list</strong></span> uses to
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User display it), or all keys. In either case, only
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User completed keys are removed; any record indicating
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User that a key has not yet finished signing the zone
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User will be retained.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span><strong class="command">rndc signing -nsec3param</strong></span> sets
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User the NSEC3 parameters for a zone. This is the
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User only supported mechanism for using NSEC3 with
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span><strong class="command">inline-signing</strong></span> zones.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Parameters are specified in the same format as
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User an NSEC3PARAM resource record: hash algorithm,
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews flags, iterations, and salt, in that order.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </p>
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater<p>
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater Currently, the only defined value for hash algorithm
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater is <code class="literal">1</code>, representing SHA-1.
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater The <code class="option">flags</code> may be set to
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater <code class="literal">0</code> or <code class="literal">1</code>,
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater depending on whether you wish to set the opt-out
77dccf2a5d9327d16b4374a135cdb99bdd48620eAutomatic Updater bit in the NSEC3 chain. <code class="option">iterations</code>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User defines the number of additional times to apply
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the algorithm when generating an NSEC3 hash. The
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <code class="option">salt</code> is a string of data expressed
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User in hexadecimal, or a hyphen (`-') if no salt is
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User to be used.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User So, for example, to create an NSEC3 chain using
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews the SHA-1 hash algorithm, no opt-out flag,
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User 10 iterations, and a salt value of "FFFF", use:
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span><strong class="command">rndc signing -nsec3param 1 0 10 FFFF <em class="replaceable"><code>zone</code></em></strong></span>.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User To set the opt-out flag, 15 iterations, and no
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User salt, use:
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span><strong class="command">rndc signing -nsec3param 1 1 15 - <em class="replaceable"><code>zone</code></em></strong></span>.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span><strong class="command">rndc signing -nsec3param none</strong></span>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User removes an existing NSEC3 chain and replaces it
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User with NSEC.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</dd>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</dl></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</div>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<div class="refsect1" lang="en">
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<a name="id2683066"></a><h2>LIMITATIONS</h2>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User There is currently no way to provide the shared secret for a
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <code class="option">key_id</code> without using the configuration file.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User Several error messages could be clearer.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
be6c1c506161e6f45fcff5d0425f78801bc267c1Automatic Updater</div>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<div class="refsect1" lang="en">
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<a name="id2683084"></a><h2>SEE ALSO</h2>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
9054d0bb0301aa04ea1ff700ebe4beaf0b573d24Tinderbox User <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</div>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<div class="refsect1" lang="en">
be6c1c506161e6f45fcff5d0425f78801bc267c1Automatic Updater<a name="id2683140"></a><h2>AUTHOR</h2>
be6c1c506161e6f45fcff5d0425f78801bc267c1Automatic Updater<p><span class="corpauthor">Internet Systems Consortium</span>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User </p>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</div>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</div>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<div class="navfooter">
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<hr>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<table width="100%" summary="Navigation footer">
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<tr>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<td width="40%" align="left">
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<a accesskey="p" href="man.nsupdate.html">Prev</a>�</td>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<td width="40%" align="right">�<a accesskey="n" href="man.rndc.conf.html">Next</a>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</td>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</tr>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<tr>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<td width="40%" align="left" valign="top">
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<span class="application">nsupdate</span>�</td>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<td width="40%" align="right" valign="top">�<code class="filename">rndc.conf</code>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</td>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</tr>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</table>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews</body>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User</html>
8e16b3078757ba3010c24aef805e9e29ed19518bTinderbox User