man.rndc.html revision 50066670817cdf9e86c832066d73715232b29680
c63ebf815c8a874525cf18670ad74847f7fc7b26Christian Maeder - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder - Copyright (C) 2000-2003 Internet Software Consortium.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - Permission to use, copy, modify, and/or distribute this software for any
43b4c41fbb07705c9df321221ab9cb9832460407Christian Maeder - purpose with or without fee is hereby granted, provided that the above
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - copyright notice and this permission notice appear in all copies.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
43b4c41fbb07705c9df321221ab9cb9832460407Christian Maeder - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
f4a2a20e49f41b2afa657e5e64d9e349c7faa091Christian Maeder - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
f2f9df2e17e70674f0bf426ed1763c973ee4cde0Christian Maeder - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder - PERFORMANCE OF THIS SOFTWARE.
a53841f6d6e86ac751c12a33dc8aadf53f59d977Klaus Luettich<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
a737caf82de97c1907027c03e4b4509eb492b4b8Christian Maeder<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
68d10d143f29fcff3c637ba24f90e983995ceae6Christian Maeder<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
96646aed2ae087b942ae23f15bbe729a8f7c43d3Christian Maeder<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
01e383014b555bbcf639c0ca60c5810b3eff83c0Christian Maeder<link rel="prev" href="man.nsupdate.html" title="nsupdate">
3b06e23643a9f65390cb8c1caabe83fa7e87a708Till Mossakowski<link rel="next" href="man.rndc.conf.html" title="rndc.conf">
a6db617ca58eb6a0587b6366e913107dfecb71b5Heng Jiang<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder<table width="100%" summary="Navigation header">
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder<tr><th colspan="3" align="center"><span class="application">rndc</span></th></tr>
a1ed34933c266ce85066acb0d7b20c90cb8eb213Christian Maeder<a accesskey="p" href="man.nsupdate.html">Prev</a>�</td>
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder<th width="60%" align="center">Manual pages</th>
8410667510a76409aca9bb24ff0eda0420088274Christian Maeder<td width="20%" align="right">�<a accesskey="n" href="man.rndc.conf.html">Next</a>
4d56f2fa72e4aec20eb827c11ed49c8cbb7014bdChristian Maeder<a name="man.rndc"></a><div class="titlepage"></div>
404166b9366552e9ec5abb87a37c76ec8a815fb7Klaus Luettich<p><span class="application">rndc</span> — name server control utility</p>
55adfe57a4de1f36adc3e3bfc16f342e44a7d444Christian Maeder<div class="cmdsynopsis"><p><code class="command">rndc</code> [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
f4a2a20e49f41b2afa657e5e64d9e349c7faa091Christian Maeder<a name="id2653201"></a><h2>DESCRIPTION</h2>
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder<p><span><strong class="command">rndc</strong></span>
e593b89bfd4952698dc37feced21cefe869d87a2Christian Maeder controls the operation of a name
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder server. It supersedes the <span><strong class="command">ndc</strong></span> utility
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder that was provided in old BIND releases. If
7cc09dd93962a2155c34d209d1d4cd7d7b838264Christian Maeder <span><strong class="command">rndc</strong></span> is invoked with no command line
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder options or arguments, it prints a short summary of the
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder supported commands and the available options and their
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder<p><span><strong class="command">rndc</strong></span>
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder communicates with the name server over a TCP connection, sending
c3053d57f642ca507cdf79512e604437c4546cb9Christian Maeder commands authenticated with digital signatures. In the current
f4a2a20e49f41b2afa657e5e64d9e349c7faa091Christian Maeder <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>,
f4a2a20e49f41b2afa657e5e64d9e349c7faa091Christian Maeder the only supported authentication algorithms are HMAC-MD5
dcbd32289a7bdf1e6edd06c6ab0698c6a9dbf37aChristian Maeder (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
2c9df69accd8924e7cef3bf8f686626958499c7aChristian Maeder (default), HMAC-SHA384 and HMAC-SHA512.
c2fcc35abb03cf0b4ca4b050efeb10827f38c322Christian Maeder They use a shared secret on each end of the connection.
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder This provides TSIG-style authentication for the command
356fa49fe3e6a8398f92d13e9f920d0f093697ecChristian Maeder request and the name server's response. All commands sent
356fa49fe3e6a8398f92d13e9f920d0f093697ecChristian Maeder over the channel must be signed by a key_id known to the
356fa49fe3e6a8398f92d13e9f920d0f093697ecChristian Maeder<p><span><strong class="command">rndc</strong></span>
0206ab93ef846e4e0885996d052b9b73b9dc66b0Christian Maeder reads a configuration file to
f13d1e86e58da53680e78043e8df182eed867efbChristian Maeder determine how to contact the name server and decide what
c2a4d8ae266aa37cc922eba97077520229a19902Christian Maeder algorithm and key it should use.
ecf76bc89d9a2ecd7ac7310d30654b9a79d97d62Klaus Luettich<dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
ecf76bc89d9a2ecd7ac7310d30654b9a79d97d62Klaus Luettich Use <em class="replaceable"><code>source-address</code></em>
36f63902db2b3463faa9f59912ad106e2d5aaa24Klaus Luettich as the source address for the connection to the server.
36f63902db2b3463faa9f59912ad106e2d5aaa24Klaus Luettich Multiple instances are permitted to allow setting of both
f04e8f3ff56405901be968fd4c6e9769239f1a9bKlaus Luettich the IPv4 and IPv6 source addresses.
8cacad2a09782249243b80985f28e9387019fe40Christian Maeder<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
a7c27282e71cf4505026645f96d4f5cb8a284e32Christian Maeder Use <em class="replaceable"><code>config-file</code></em>
363939beade943a02b31004cea09dec34fa8a6d9Christian Maeder as the configuration file instead of the default,
8a28707e9155465c6f2236a06eac6580a65c7025Christian Maeder <code class="filename">/etc/rndc.conf</code>.
797ccd67cb8ae127be097cd43448801b673e3b69Christian Maeder<dt><span class="term">-k <em class="replaceable"><code>key-file</code></em></span></dt>
431d34c7007a787331c4e5ec997badb0f8190fc7Christian Maeder Use <em class="replaceable"><code>key-file</code></em>
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder as the key file instead of the default,
d3ae0072823e2ef0d41d4431fcc768e66489c20eChristian Maeder <code class="filename">/etc/rndc.key</code>. The key in
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder <code class="filename">/etc/rndc.key</code> will be used to
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder commands sent to the server if the <em class="replaceable"><code>config-file</code></em>
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder does not exist.
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder<dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt>
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder<dd><p><em class="replaceable"><code>server</code></em> is
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder the name or address of the server which matches a
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder server statement in the configuration file for
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder <span><strong class="command">rndc</strong></span>. If no server is supplied on the
a6db617ca58eb6a0587b6366e913107dfecb71b5Heng Jiang command line, the host named by the default-server clause
a6082d6cfdfbdc6a4e70430bb25638dfa4f0db9bHeng Jiang in the options statement of the <span><strong class="command">rndc</strong></span>
a6082d6cfdfbdc6a4e70430bb25638dfa4f0db9bHeng Jiang configuration file will be used.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
498aa48bdb931ab50990d3b74318a5db2312186cChristian Maeder Send commands to TCP port
f1541d4a151dbd08002dbd14e7eb1d5dde253689Christian Maeder <em class="replaceable"><code>port</code></em>
6dc9bc98d0854fe2e3dd3bfc4275096a0c28ee1cChristian Maeder of BIND 9's default control channel port, 953.
c0c2380bced8159ff0297ece14eba948bd236471Christian Maeder Enable verbose logging.
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt>
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder Use the key <em class="replaceable"><code>key_id</code></em>
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder from the configuration file.
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder <em class="replaceable"><code>key_id</code></em>
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder known by named with the same algorithm and secret string
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder in order for control message validation to succeed.
03a6d8f77f588dc5d3dd6653797fa2362efa1751Christian Maeder If no <em class="replaceable"><code>key_id</code></em>
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder is specified, <span><strong class="command">rndc</strong></span> will first look
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder for a key clause in the server statement of the server
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder being used, or if no server statement is present for that
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder host, then the default-key clause of the options statement.
a5e5b8c3e5c11177e5034ef2423813a5d28979edChristian Maeder Note that the configuration file contains shared secrets
bc8cbf12aa172bf5673b92a9e7a0151d4aa4c315Christian Maeder which are used to send authenticated control commands
2d130d212db7208777ca896a7ecad619a8944971Christian Maeder to name servers. It should therefore not have general read
2d130d212db7208777ca896a7ecad619a8944971Christian Maeder or write access.
2d130d212db7208777ca896a7ecad619a8944971Christian Maeder A list of commands supported by <span><strong class="command">rndc</strong></span> can
2d130d212db7208777ca896a7ecad619a8944971Christian Maeder be seen by running <span><strong class="command">rndc</strong></span> without arguments.
6ff7a91875597d6e4dfaa68c79187d01473e8341Christian Maeder Currently supported commands are:
4017ebc0f692820736d796af3110c3b3018c108aChristian Maeder<dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder Reload configuration file and zones.
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder<dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
88318aafc287e92931dceffbb943d58a9310001dChristian Maeder Reload the given zone.
a3c6d8e0670bf2aa71bc8e2a3b1f45d56dd65e4cChristian Maeder<dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder Schedule zone maintenance for the given zone.
363939beade943a02b31004cea09dec34fa8a6d9Christian Maeder<dt><span class="term"><strong class="userinput"><code>retransfer <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder Retransfer the given slave zone from the master server.
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder If the zone is configured to use
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder <span><strong class="command">inline-signing</strong></span>, the signed
4017ebc0f692820736d796af3110c3b3018c108aChristian Maeder version of the zone is discarded; after the
b568982efd0997d877286faa592d81b03c8c67b8Christian Maeder retransfer of the unsigned version is complete, the
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder signed version will be regenerated with all new
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder<dt><span class="term"><strong class="userinput"><code>sign <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
d946c1bfdd7d58aa7c023efe864d5999eb44a61bChristian Maeder Fetch all DNSSEC keys for the given zone
d946c1bfdd7d58aa7c023efe864d5999eb44a61bChristian Maeder from the key directory (see the
d946c1bfdd7d58aa7c023efe864d5999eb44a61bChristian Maeder <span><strong class="command">key-directory</strong></span> option in
d946c1bfdd7d58aa7c023efe864d5999eb44a61bChristian Maeder the BIND 9 Administrator Reference Manual). If they are within
d946c1bfdd7d58aa7c023efe864d5999eb44a61bChristian Maeder their publication period, merge them into the
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder zone's DNSKEY RRset. If the DNSKEY RRset
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder is changed, then the zone is automatically
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder re-signed with the new key set.
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder This command requires that the
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder <span><strong class="command">auto-dnssec</strong></span> zone option be set
ca074a78b8dcccbb8c419586787882f98d0c6163Christian Maeder and also requires the zone to be configured to
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder allow dynamic DNS.
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder (See "Dynamic Update Policies" in the Administrator
f1541d4a151dbd08002dbd14e7eb1d5dde253689Christian Maeder Reference Manual for more details.)
e6d5dbbc3308f05197868806e0b860f4f53875f1Christian Maeder<dt><span class="term"><strong class="userinput"><code>loadkeys <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
f1541d4a151dbd08002dbd14e7eb1d5dde253689Christian Maeder Fetch all DNSSEC keys for the given zone
363939beade943a02b31004cea09dec34fa8a6d9Christian Maeder from the key directory. If they are within
363939beade943a02b31004cea09dec34fa8a6d9Christian Maeder their publication period, merge them into the
f4505a64a089693012a3f5c3b1f12a82cd7a2a5aKlaus Luettich zone's DNSKEY RRset. Unlike <span><strong class="command">rndc
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder sign</strong></span>, however, the zone is not
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder immediately re-signed by the new keys, but is
f4505a64a089693012a3f5c3b1f12a82cd7a2a5aKlaus Luettich allowed to incrementally re-sign over time.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder This command requires that the
2c619a4dfdc1df27573eba98e81ed1ace906941dChristian Maeder <span><strong class="command">auto-dnssec</strong></span> zone option
b886e9e5db2098d0112cc4f70aeba232962939ddChristian Maeder be set to <code class="literal">maintain</code>,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder and also requires the zone to be configured to
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder allow dynamic DNS.
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder (See "Dynamic Update Policies" in the Administrator
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Reference Manual for more details.)
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder<dt><span class="term"><strong class="userinput"><code>freeze [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder Suspend updates to a dynamic zone. If no zone is
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder specified, then all zones are suspended. This allows
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder manual edits to be made to a zone normally updated by
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder dynamic update. It also causes changes in the
93f5b72fdb9ee734caa750b43dd79bbb590dcd73Christian Maeder journal file to be synced into the master file.
93f5b72fdb9ee734caa750b43dd79bbb590dcd73Christian Maeder All dynamic update attempts will be refused while
93f5b72fdb9ee734caa750b43dd79bbb590dcd73Christian Maeder the zone is frozen.
93f5b72fdb9ee734caa750b43dd79bbb590dcd73Christian Maeder<dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
5b818f10e11fc79def1fdd5c8a080d64a6438d87Christian Maeder Enable updates to a frozen dynamic zone. If no
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers zone is specified, then all frozen zones are
819e29dba060687cf391e444e0f6ff88c1908cc3Christian Maeder enabled. This causes the server to reload the zone
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder from disk, and re-enables dynamic updates after the
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder load has completed. After a zone is thawed,
f9e0b18852b238ddb649d341194e05d7200d1bbeChristian Maeder dynamic updates will no longer be refused. If
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers the zone has changed and the
9e748851c150e1022fb952bab3315e869aaf0214Christian Maeder <span><strong class="command">ixfr-from-differences</strong></span> option is
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder in use, then the journal file will be updated to
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder reflect changes in the zone. Otherwise, if the
383aa66e5142365fe9b1f88b18c1da5b27cc8c04Christian Maeder zone has changed, any existing journal file will be
383aa66e5142365fe9b1f88b18c1da5b27cc8c04Christian Maeder<dt><span class="term"><strong class="userinput"><code>scan</code></strong></span></dt>
383aa66e5142365fe9b1f88b18c1da5b27cc8c04Christian Maeder Scan the list of available network interfaces
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder for changes, without performing a full
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder <span><strong class="command">reconfig</strong></span> or waiting for the
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder <span><strong class="command">interface-interval</strong></span> timer.
f9e0b18852b238ddb649d341194e05d7200d1bbeChristian Maeder<dt><span class="term"><strong class="userinput"><code>sync [<span class="optional">-clean</span>] [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
819e29dba060687cf391e444e0f6ff88c1908cc3Christian Maeder Sync changes in the journal file for a dynamic zone
819e29dba060687cf391e444e0f6ff88c1908cc3Christian Maeder to the master file. If the "-clean" option is
819e29dba060687cf391e444e0f6ff88c1908cc3Christian Maeder specified, the journal file is also removed. If
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder no zone is specified, then all zones are synced.
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder<dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder Resend NOTIFY messages for the zone.
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder<dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder Reload the configuration file and load new zones,
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder but do not reload existing zone files even if they
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder have changed.
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder This is faster than a full <span><strong class="command">reload</strong></span> when there
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder is a large number of zones because it avoids the need
ac34194a668399bb8ef238da77c3a09e93fb253bChristian Maeder to examine the
ac34194a668399bb8ef238da77c3a09e93fb253bChristian Maeder modification times of the zones files.
1842453990fed8a1bd7a5ac792d7982c1d2bfcd5Christian Maeder<dt><span class="term"><strong class="userinput"><code>zonestatus [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
1842453990fed8a1bd7a5ac792d7982c1d2bfcd5Christian Maeder Displays the current status of the given zone,
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder including the master file name and any include
986d3f255182539098a97ac86da9eeee5b7a72e3Christian Maeder files from which it was loaded, when it was most
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder recently loaded, the current serial number, the
4561227a776bdf0ab679b19fb92f1eaaed8786f7Christian Maeder number of nodes, whether the zone supports
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder dynamic updates, whether the zone is DNSSEC
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder signed, whether it uses automatic DNSSEC key
5ad5dffe06818a13e1632b1119fbca7881085fc1Dominik Luecke management or inline signing, and the scheduled
8c812cd83569e973f10cf69a342424ceabc07af9Christian Maeder refresh or expiry times for the zone.
8c812cd83569e973f10cf69a342424ceabc07af9Christian Maeder<dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt>
3b06e23643a9f65390cb8c1caabe83fa7e87a708Till Mossakowski Write server statistics to the statistics file.
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder<dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional">on|off</span>] </span></dt>
8c812cd83569e973f10cf69a342424ceabc07af9Christian Maeder Enable or disable query logging. (For backward
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder compatibility, this command can also be used without
fb328c4f646dd3dd78a9391c5cb58450a3dd0aa9Klaus Luettich an argument to toggle query logging on and off.)
abf2487c3aece95c371ea89ac64319370dcb6483Klaus Luettich Query logging can also be enabled
c70ef4c3b3a62764f715510c9fd67dde3acfe454Christian Maeder by explicitly directing the <span><strong class="command">queries</strong></span>
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <span><strong class="command">category</strong></span> to a
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <span><strong class="command">channel</strong></span> in the
8b0f493ae42bad8b94918cc0957f1af57096cda4Felix Reckers <span><strong class="command">logging</strong></span> section of
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder <code class="filename">named.conf</code> or by specifying
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <span><strong class="command">querylog yes;</strong></span> in the
b9b960bc75e34658e70c4a0231dbc6a6e7373f2dChristian Maeder <span><strong class="command">options</strong></span> section of
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder<dt><span class="term"><strong class="userinput"><code>dumpdb [<span class="optional">-all|-cache|-zone</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
43b4c41fbb07705c9df321221ab9cb9832460407Christian Maeder Dump the server's caches (default) and/or zones to
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder dump file for the specified views. If no view is
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder specified, all
f4a2a20e49f41b2afa657e5e64d9e349c7faa091Christian Maeder views are dumped.
edd1b7f4720bc2eea51fa0685417e1e4f3be4915Klaus Luettich<dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
63e50b4c36074d5fb9de872c4007b688b4bce534Christian Maeder Dump the server's security roots to the secroots
bd54a9917cd87169b8e40bcc5616c537fed85815Christian Maeder file for the specified views. If no view is
be218d4b48c5447b7b08c1e323e048a0cfae2d6eHendrik Iben specified, security roots for all
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder views are dumped.
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder<dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt>
6a79849bed67264c396dddb3e9c184bdfc1a1bc9Christian Maeder Stop the server, making sure any recent changes
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder made through dynamic update or IXFR are first saved to
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder the master files of the updated zones.
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder This allows an external process to determine when <span><strong class="command">named</strong></span>
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder had completed stopping.
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder<dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt>
f04e8f3ff56405901be968fd4c6e9769239f1a9bKlaus Luettich Stop the server immediately. Recent changes
e8db9a65830cf71504e33c6f441a67b4d184a3caChristian Maeder made through dynamic update or IXFR are not saved to
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder the master files, but will be rolled forward from the
1f8a7f8343f7df719768d2b1d7e3077ee291a1caChristian Maeder journal files when the server is restarted.
1f8a7f8343f7df719768d2b1d7e3077ee291a1caChristian Maeder If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder This allows an external process to determine when <span><strong class="command">named</strong></span>
6bf24e5eb644064ad650eb3fd9774483fccbf601Christian Maeder had completed halting.
53818ced114da21321063fff307aa41c1ab31dd3Achim Mahnke<dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
53818ced114da21321063fff307aa41c1ab31dd3Achim Mahnke Increment the servers debugging level by one.
53818ced114da21321063fff307aa41c1ab31dd3Achim Mahnke<dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Sets the server's debugging level to an explicit
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder<dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt>
f443a57f2a8e0ca3daa7431b0c89a18ba52c337aChristian Maeder Sets the server's debugging level to 0.
0b349288edfa50fdf38fda1a14e1562d03f92574Christian Maeder<dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt>
857992065be4ed40a72c6296b6c0aec62ab4c5b9Christian Maeder Flushes the server's cache.
7c99e334446bb97120e30e967baeeddfdd1278deKlaus Luettich<dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
dcbd32289a7bdf1e6edd06c6ab0698c6a9dbf37aChristian Maeder Flushes the given name from the server's DNS cache
dcbd32289a7bdf1e6edd06c6ab0698c6a9dbf37aChristian Maeder and, if applicable, from the server's nameserver address
f4a2a20e49f41b2afa657e5e64d9e349c7faa091Christian Maeder database or bad-server cache.
f041c9a6bda23de33a38490e35b831ae18d96b45Christian Maeder<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> [<span class="optional">-all</span>] <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder Flushes the given name, and all of its subdomains,
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder from the server's DNS cache, the address database,
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder and the bad server cache.
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder<dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
dcbd32289a7bdf1e6edd06c6ab0698c6a9dbf37aChristian Maeder Display status of the server.
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder Note that the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder and the default <span><strong class="command">/IN</strong></span>
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder hint zone if there is not an
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder explicit root zone configured.
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder<dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt>
215d42ce4d6397a453d5887292bc786e8fa9c1a2Christian Maeder Dump the list of queries <span><strong class="command">named</strong></span> is currently recursing
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder<dt><span class="term"><strong class="userinput"><code>validation ( on | off | check ) [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>] </code></strong></span></dt>
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder Enable, disable, or check the current status of
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder DNSSEC validation.
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
215d42ce4d6397a453d5887292bc786e8fa9c1a2Christian Maeder set to <strong class="userinput"><code>yes</code></strong> or
215d42ce4d6397a453d5887292bc786e8fa9c1a2Christian Maeder <strong class="userinput"><code>auto</code></strong> to be effective.
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder It defaults to enabled.
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder<dt><span class="term"><strong class="userinput"><code>tsig-list</code></strong></span></dt>
215d42ce4d6397a453d5887292bc786e8fa9c1a2Christian Maeder List the names of all TSIG keys currently configured
215d42ce4d6397a453d5887292bc786e8fa9c1a2Christian Maeder for use by <span><strong class="command">named</strong></span> in each view. The
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder list both statically configured keys and dynamic
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maeder TKEY-negotiated keys.
27785f379d6810811b4e6d23feab18845fde9a98Christian Maeder<dt><span class="term"><strong class="userinput"><code>tsig-delete</code></strong> <em class="replaceable"><code>keyname</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span></dt>
b886e9e5db2098d0112cc4f70aeba232962939ddChristian Maeder Delete a given TKEY-negotiated key from the server.
27785f379d6810811b4e6d23feab18845fde9a98Christian Maeder (This does not apply to statically configured TSIG
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder<dt><span class="term"><strong class="userinput"><code>addzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] <em class="replaceable"><code>configuration</code></em> </code></strong></span></dt>
83394c6b6e6de128e71b67c9251ed7a84485d082Christian Maeder Add a zone while the server is running. This
fa21fba9ceb1ddf7b3efd54731a12ed8750191d8Christian Maeder command requires the
fa21fba9ceb1ddf7b3efd54731a12ed8750191d8Christian Maeder <span><strong class="command">allow-new-zones</strong></span> option to be set
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder to <strong class="userinput"><code>yes</code></strong>. The
0c355dd0b739631ee472f9a656e266be27fa4e64Christian Maeder <em class="replaceable"><code>configuration</code></em> string
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder specified on the command line is the zone
fa21fba9ceb1ddf7b3efd54731a12ed8750191d8Christian Maeder configuration text that would ordinarily be
b49276c9f50038e0bd499ad49f7bd6444566a834Christian Maeder placed in <code class="filename">named.conf</code>.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder The configuration is saved in a file called
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder <code class="filename"><em class="replaceable"><code>hash</code></em>.nzf</code>,
c7ec85d1103173e089aa5048fd7afb2f9b505124Klaus Luettich where <em class="replaceable"><code>hash</code></em> is a
c7ec85d1103173e089aa5048fd7afb2f9b505124Klaus Luettich cryptographic hash generated from the name of
c7ec85d1103173e089aa5048fd7afb2f9b505124Klaus Luettich the view. When <span><strong class="command">named</strong></span> is
c7ec85d1103173e089aa5048fd7afb2f9b505124Klaus Luettich restarted, the file will be loaded into the view
c7ec85d1103173e089aa5048fd7afb2f9b505124Klaus Luettich configuration, so that zones that were added
b905126bab9454b89041f92b3c50bb9efc85e427Klaus Luettich can persist after a restart.
b905126bab9454b89041f92b3c50bb9efc85e427Klaus Luettich This sample <span><strong class="command">addzone</strong></span> command
c4ef79587a902327f36277c45a8d91d1e67bd6d5Klaus Luettich would add the zone <code class="literal">example.com</code>
c4ef79587a902327f36277c45a8d91d1e67bd6d5Klaus Luettich to the default view:
5818d884784339c1b8aa6c6d972bad4eafd36ccbKlaus Luettich<code class="prompt">$ </code><strong class="userinput"><code>rndc addzone example.com '{ type master; file "example.com.db"; };'</code></strong>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder (Note the brackets and semi-colon around the zone
b905126bab9454b89041f92b3c50bb9efc85e427Klaus Luettich configuration text.)
b905126bab9454b89041f92b3c50bb9efc85e427Klaus Luettich<dt><span class="term"><strong class="userinput"><code>delzone [<span class="optional">-clean</span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder Delete a zone while the server is running.
dbe752ee940baae7f9f231f29c62284bb0f90a25Christian Maeder Only zones that were originally added via
1f8a7f8343f7df719768d2b1d7e3077ee291a1caChristian Maeder <span><strong class="command">rndc addzone</strong></span> can be deleted
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder in this manner.
c1bf9cc3bc3729b0bf925be3be123cbb59bea2a6Christian Maeder If the <code class="option">-clean</code> is specified,
c1bf9cc3bc3729b0bf925be3be123cbb59bea2a6Christian Maeder the zone's master file (and journal file, if any)
1f8a7f8343f7df719768d2b1d7e3077ee291a1caChristian Maeder will be deleted along with the zone. Without the
96646aed2ae087b942ae23f15bbe729a8f7c43d3Christian Maeder <code class="option">-clean</code> option, zone files must
96646aed2ae087b942ae23f15bbe729a8f7c43d3Christian Maeder be cleaned up by hand. (If the zone is of
1f8a7f8343f7df719768d2b1d7e3077ee291a1caChristian Maeder type "slave" or "stub", the files needing to
3a7788e09dd23b364a46c9488cbd1522369113dbChristian Maeder be cleaned up will be reported in the output
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder of the <span><strong class="command">rndc delzone</strong></span> command.)
ef67402074be14deb95e4ff564737d5593144130Klaus Luettich<dt><span class="term"><strong class="userinput"><code>signing [<span class="optional">( -list | -clear <em class="replaceable"><code>keyid/algorithm</code></em> | -clear <code class="literal">all</code> | -nsec3param ( <em class="replaceable"><code>parameters</code></em> | <code class="literal">none</code> ) ) </span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
e7e1ab2ac3f1fded8611bb92ae00e8f3b8c693fbKlaus Luettich List, edit, or remove the DNSSEC signing state for
ef67402074be14deb95e4ff564737d5593144130Klaus Luettich the specified zone. The status of ongoing DNSSEC
1323eba62fc519b068f5aaec4f9d2be05ffabea9Klaus Luettich operations (such as signing or generating
a80c28bb8b7a23ccdf7e08d0fe216fc19cc97273Klaus Luettich NSEC3 chains) is stored in the zone in the form
d784803f9c752667b4fcf7393d698002bedf3f89Klaus Luettich of DNS resource records of type
1323eba62fc519b068f5aaec4f9d2be05ffabea9Klaus Luettich <span><strong class="command">sig-signing-type</strong></span>.
1323eba62fc519b068f5aaec4f9d2be05ffabea9Klaus Luettich <span><strong class="command">rndc signing -list</strong></span> converts
1f8a7f8343f7df719768d2b1d7e3077ee291a1caChristian Maeder these records into a human-readable form,
1f8a7f8343f7df719768d2b1d7e3077ee291a1caChristian Maeder indicating which keys are currently signing
462d9dc583444aab82732e14a75610684d2dc7e9Christian Maeder or have finished signing the zone, and which NSEC3
5d39c60274aaa76506292d2d9e885fccd27e1eabChristian Maeder chains are being created or removed.
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder <span><strong class="command">rndc signing -clear</strong></span> can remove
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder a single key (specified in the same format that
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder <span><strong class="command">rndc signing -list</strong></span> uses to
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder display it), or all keys. In either case, only
1f8a7f8343f7df719768d2b1d7e3077ee291a1caChristian Maeder completed keys are removed; any record indicating
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder that a key has not yet finished signing the zone
aebb0b18fe5e6ba7dd7e4c66a16a905611ef7ba9Christian Maeder will be retained.
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder <span><strong class="command">rndc signing -nsec3param</strong></span> sets
aebb0b18fe5e6ba7dd7e4c66a16a905611ef7ba9Christian Maeder the NSEC3 parameters for a zone. This is the
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder only supported mechanism for using NSEC3 with
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder <span><strong class="command">inline-signing</strong></span> zones.
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder Parameters are specified in the same format as
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder an NSEC3PARAM resource record: hash algorithm,
f2d9352f2999f82c36b4b65535d14a6a40ae5a82Christian Maeder flags, iterations, and salt, in that order.
f2d9352f2999f82c36b4b65535d14a6a40ae5a82Christian Maeder Currently, the only defined value for hash algorithm
340706b6c0c6e3dbacdd7003e20e9cab7f9aa765Christian Maeder is <code class="literal">1</code>, representing SHA-1.
fdb2d618144159395f7bf8ce3327b3c112a17dd3Till Mossakowski The <code class="option">flags</code> may be set to
fa0f3519d71f719d88577b716b1579776b4a2535Christian Maeder <code class="literal">0</code> or <code class="literal">1</code>,
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maeder depending on whether you wish to set the opt-out
99afa6000472f3d291fdf9193ea19d334a58658dChristian Maeder bit in the NSEC3 chain. <code class="option">iterations</code>
fa0f3519d71f719d88577b716b1579776b4a2535Christian Maeder defines the number of additional times to apply
ac0bbbcb2774629bb87986e69cf53d3402c5f575Christian Maeder the algorithm when generating an NSEC3 hash. The
c22d75ec3ea1306219d1c09a5b3e8ff04f753ad6Christian Maeder <code class="option">salt</code> is a string of data expressed
9c3edf2b283c09d33b2820696886d1ed32fcadc8Christian Maeder in hexadecimal, or a hyphen (`-') if no salt is
99afa6000472f3d291fdf9193ea19d334a58658dChristian Maeder So, for example, to create an NSEC3 chain using
5bb7eeaca10ea76595229375f907a5a388b7c882Christian Maeder the SHA-1 hash algorithm, no opt-out flag,
5bb7eeaca10ea76595229375f907a5a388b7c882Christian Maeder 10 iterations, and a salt value of "FFFF", use:
5bb7eeaca10ea76595229375f907a5a388b7c882Christian Maeder <span><strong class="command">rndc signing -nsec3param 1 0 10 FFFF <em class="replaceable"><code>zone</code></em></strong></span>.
c59d1c38ef94b4fb1c8d9fda9573bc1e1d2801e7Christian Maeder To set the opt-out flag, 15 iterations, and no
99afa6000472f3d291fdf9193ea19d334a58658dChristian Maeder <span><strong class="command">rndc signing -nsec3param 1 1 15 - <em class="replaceable"><code>zone</code></em></strong></span>.
ddc9315cc0b1f5dd3d8f99a77f1c75064db33b48Christian Maeder <span><strong class="command">rndc signing -nsec3param none</strong></span>
ddc9315cc0b1f5dd3d8f99a77f1c75064db33b48Christian Maeder removes an existing NSEC3 chain and replaces it
b1f59a4ea7c96f4c03a4d7cfcb9c5e66871cfbbbChristian Maeder<a name="id2686382"></a><h2>LIMITATIONS</h2>
e62d49c0dc2893da75faad896bd135e2e9a7087bKlaus Luettich There is currently no way to provide the shared secret for a
e62d49c0dc2893da75faad896bd135e2e9a7087bKlaus Luettich <code class="option">key_id</code> without using the configuration file.
3e61f574717499939bd8e0ff538ea9e7b72d4e2dKlaus Luettich Several error messages could be clearer.
3e61f574717499939bd8e0ff538ea9e7b72d4e2dKlaus Luettich<p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
3e61f574717499939bd8e0ff538ea9e7b72d4e2dKlaus Luettich <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
3e61f574717499939bd8e0ff538ea9e7b72d4e2dKlaus Luettich <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
3e61f574717499939bd8e0ff538ea9e7b72d4e2dKlaus Luettich <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
36f63902db2b3463faa9f59912ad106e2d5aaa24Klaus Luettich <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
3e61f574717499939bd8e0ff538ea9e7b72d4e2dKlaus Luettich <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
ac43fa22d2d3f91a17674ac164cba3cf39a17795Klaus Luettich<p><span class="corpauthor">Internet Systems Consortium</span>
18c1d987ce5818ecf0bfc8af3f43aed2ce86e1eaChristian Maeder<table width="100%" summary="Navigation footer">
b891e9ad7dd358a7df24b59bf00d51515078497cChristian Maeder<a accesskey="p" href="man.nsupdate.html">Prev</a>�</td>
5ad5dffe06818a13e1632b1119fbca7881085fc1Dominik Luecke<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder<td width="40%" align="right">�<a accesskey="n" href="man.rndc.conf.html">Next</a>
61fa0ac06ede811c7aad54ec4c4202346727368eChristian Maeder<span class="application">nsupdate</span>�</td>
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder<td width="40%" align="right" valign="top">�<code class="filename">rndc.conf</code>