2N/A - Copyright (C) 2000-2016 Internet Systems Consortium, Inc. ("ISC") 2N/A - This Source Code Form is subject to the terms of the Mozilla Public 2N/A - License, v. 2.0. If a copy of the MPL was not distributed with this 2N/A<
meta http-
equiv="Content-Type" content="text/html; charset=ISO-8859-1">
2N/A<
meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
2N/A<
link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
2N/A<
body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
2N/A<
div class="navheader">
2N/A<
table width="100%" summary="Navigation header">
2N/A<
tr><
th colspan="3" align="center"><
span class="application">rndc</
span></
th></
tr>
2N/A<
td width="20%" align="left">
2N/A<
th width="60%" align="center">Manual pages</
th>
2N/A<
div class="refentry">
2N/A<
div class="refnamediv">
2N/A<
p><
span class="application">rndc</
span> — name server control utility</
p>
2N/A<
div class="refsynopsisdiv">
2N/A<
div class="cmdsynopsis"><
p><
code class="command">rndc</
code> [<
code class="option">-b <
em class="replaceable"><
code>source-address</
code></
em></
code>] [<
code class="option">-c <
em class="replaceable"><
code>config-file</
code></
em></
code>] [<
code class="option">-k <
em class="replaceable"><
code>key-file</
code></
em></
code>] [<
code class="option">-s <
em class="replaceable"><
code>server</
code></
em></
code>] [<
code class="option">-p <
em class="replaceable"><
code>port</
code></
em></
code>] [<
code class="option">-q</
code>] [<
code class="option">-r</
code>] [<
code class="option">-V</
code>] [<
code class="option">-y <
em class="replaceable"><
code>key_id</
code></
em></
code>] {command}</
p></
div>
2N/A<
div class="refsection">
2N/A<
a name="id-1.14.27.7"></
a><
h2>DESCRIPTION</
h2>
2N/A<
p><
span class="command"><
strong>rndc</
strong></
span>
2N/A controls the operation of a name
2N/A server. It supersedes the <
span class="command"><
strong>ndc</
strong></
span> utility
2N/A that was provided in old BIND releases. If
2N/A <
span class="command"><
strong>rndc</
strong></
span> is invoked with no command line
2N/A options or arguments, it prints a short summary of the
2N/A supported commands and the available options and their
2N/A<
p><
span class="command"><
strong>rndc</
strong></
span>
2N/A communicates with the name server over a TCP connection, sending
2N/A commands authenticated with digital signatures. In the current
2N/A <
span class="command"><
strong>rndc</
strong></
span> and <
span class="command"><
strong>named</
strong></
span>,
2N/A the only supported authentication algorithms are HMAC-MD5
2N/A (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
2N/A (default), HMAC-SHA384 and HMAC-SHA512.
2N/A They use a shared secret on each end of the connection.
2N/A This provides TSIG-style authentication for the command
2N/A request and the name server's response. All commands sent
2N/A over the channel must be signed by a key_id known to the
2N/A<
p><
span class="command"><
strong>rndc</
strong></
span>
2N/A reads a configuration file to
2N/A determine how to contact the name server and decide what
2N/A algorithm and key it should use.
2N/A<
div class="refsection">
2N/A<
a name="id-1.14.27.8"></
a><
h2>OPTIONS</
h2>
2N/A<
div class="variablelist"><
dl class="variablelist">
2N/A<
dt><
span class="term">-b <
em class="replaceable"><
code>source-address</
code></
em></
span></
dt>
2N/A Use <
em class="replaceable"><
code>source-address</
code></
em>
2N/A as the source address for the connection to the server.
2N/A Multiple instances are permitted to allow setting of both
2N/A the IPv4 and IPv6 source addresses.
2N/A<
dt><
span class="term">-c <
em class="replaceable"><
code>config-file</
code></
em></
span></
dt>
2N/A Use <
em class="replaceable"><
code>config-file</
code></
em>
2N/A as the configuration file instead of the default,
2N/A<
dt><
span class="term">-k <
em class="replaceable"><
code>key-file</
code></
em></
span></
dt>
2N/A Use <
em class="replaceable"><
code>key-file</
code></
em>
2N/A as the key file instead of the default,
2N/A commands sent to the server if the <
em class="replaceable"><
code>config-file</
code></
em>
2N/A<
dt><
span class="term">-s <
em class="replaceable"><
code>server</
code></
em></
span></
dt>
2N/A<
dd><
p><
em class="replaceable"><
code>server</
code></
em> is
2N/A the name or address of the server which matches a
2N/A server statement in the configuration file for
2N/A <
span class="command"><
strong>rndc</
strong></
span>. If no server is supplied on the
2N/A command line, the host named by the default-server clause
2N/A in the options statement of the <
span class="command"><
strong>rndc</
strong></
span>
2N/A configuration file will be used.
2N/A<
dt><
span class="term">-p <
em class="replaceable"><
code>port</
code></
em></
span></
dt>
2N/A Send commands to TCP port
2N/A <
em class="replaceable"><
code>port</
code></
em>
2N/A of BIND 9's default control channel port, 953.
2N/A<
dt><
span class="term">-q</
span></
dt>
2N/A Quiet mode: Message text returned by the server
2N/A will not be printed except when there is an error.
2N/A<
dt><
span class="term">-r</
span></
dt>
2N/A Instructs <
span class="command"><
strong>rndc</
strong></
span> to print the result code
2N/A returned by <
span class="command"><
strong>named</
strong></
span> after executing the
2N/A requested command (
e.g., ISC_R_SUCCESS, ISC_R_FAILURE, etc).
2N/A<
dt><
span class="term">-V</
span></
dt>
2N/A Enable verbose logging.
2N/A<
dt><
span class="term">-y <
em class="replaceable"><
code>key_id</
code></
em></
span></
dt>
2N/A Use the key <
em class="replaceable"><
code>key_id</
code></
em>
2N/A from the configuration file.
2N/A <
em class="replaceable"><
code>key_id</
code></
em>
2N/A known by <
span class="command"><
strong>named</
strong></
span> with the same algorithm and secret string
2N/A in order for control message validation to succeed.
2N/A If no <
em class="replaceable"><
code>key_id</
code></
em>
2N/A is specified, <
span class="command"><
strong>rndc</
strong></
span> will first look
2N/A for a key clause in the server statement of the server
2N/A being used, or if no server statement is present for that
2N/A host, then the default-key clause of the options statement.
2N/A Note that the configuration file contains shared secrets
2N/A which are used to send authenticated control commands
2N/A to name servers. It should therefore not have general read
2N/A<
div class="refsection">
2N/A<
a name="id-1.14.27.9"></
a><
h2>COMMANDS</
h2>
2N/A A list of commands supported by <
span class="command"><
strong>rndc</
strong></
span> can
2N/A be seen by running <
span class="command"><
strong>rndc</
strong></
span> without arguments.
2N/A Currently supported commands are:
2N/A<
div class="variablelist"><
dl class="variablelist">
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>addzone <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>] <
em class="replaceable"><
code>configuration</
code></
em> </
code></
strong></
span></
dt>
2N/A Add a zone while the server is running. This
2N/A command requires the
2N/A <
span class="command"><
strong>allow-new-zones</
strong></
span> option to be set
2N/A to <
strong class="userinput"><
code>yes</
code></
strong>. The
2N/A <
em class="replaceable"><
code>configuration</
code></
em> string
2N/A specified on the command line is the zone
2N/A configuration text that would ordinarily be
2N/A The configuration is saved in a file called
2N/A <
code class="filename"><
em class="replaceable"><
code>name</
code></
em>.nzf</
code>,
2N/A where <
em class="replaceable"><
code>name</
code></
em> is the
2N/A name of the view, or if it contains characters
2N/A that are incompatible with use as a file name, a
2N/A cryptographic hash generated from the name
2N/A When <
span class="command"><
strong>named</
strong></
span> is
2N/A restarted, the file will be loaded into the view
2N/A configuration, so that zones that were added
2N/A can persist after a restart.
2N/A This sample <
span class="command"><
strong>addzone</
strong></
span> command
2N/A to the default view:
2N/A<
code class="prompt">$ </
code><
strong class="userinput"><
code>rndc addzone
example.com '{ type master; file "
example.com.db"; };'</
code></
strong>
2N/A (Note the brackets and semi-colon around the zone
2N/A configuration text.)
2N/A See also <
span class="command"><
strong>rndc delzone</
strong></
span> and <
span class="command"><
strong>rndc modzone</
strong></
span>.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>delzone [<
span class="optional">-clean</
span>] <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>] </
code></
strong></
span></
dt>
2N/A Delete a zone while the server is running.
2N/A If the <
code class="option">-clean</
code> argument is specified,
2N/A the zone's master file (and journal file, if any)
2N/A will be deleted along with the zone. Without the
2N/A <
code class="option">-clean</
code> option, zone files must
2N/A be cleaned up by hand. (If the zone is of
2N/A type "slave" or "stub", the files needing to
2N/A be cleaned up will be reported in the output
2N/A of the <
span class="command"><
strong>rndc delzone</
strong></
span> command.)
2N/A If the zone was originally added via
2N/A <
span class="command"><
strong>rndc addzone</
strong></
span>, then it will be
2N/A removed permanently. However, if it was originally
2N/A that original configuration is still in place; when
2N/A the server is restarted or reconfigured, the zone will
2N/A come back. To remove it permanently, it must also be
2N/A See also <
span class="command"><
strong>rndc addzone</
strong></
span> and <
span class="command"><
strong>rndc modzone</
strong></
span>.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>dnstap ( -reopen | -roll [<
span class="optional"><
em class="replaceable"><
code>number</
code></
em></
span>] )</
code></
strong></
span></
dt>
2N/A Close and re-open DNSTAP output files.
2N/A <
span class="command"><
strong>rndc dnstap -reopen</
strong></
span> allows the output
2N/A file to be renamed externally, so
2N/A that <
span class="command"><
strong>named</
strong></
span> can truncate and re-open it.
2N/A <
span class="command"><
strong>rndc dnstap -roll</
strong></
span> causes the output file
2N/A to be rolled automatically, similar to log files; the most
2N/A recent output file has ".0" appended to its name; the
2N/A previous most recent output file is moved to ".1", and so on.
2N/A If <
em class="replaceable"><
code>number</
code></
em> is specified, then the
2N/A number of backup log files is limited to that number.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>dumpdb [<
span class="optional">-all|-cache|-zone|-adb|-bad|-fail</
span>] [<
span class="optional"><
em class="replaceable"><
code>view ...</
code></
em></
span>]</
code></
strong></
span></
dt>
2N/A Dump the server's caches (default)
and/
or zones to
2N/A dump file for the specified views. If no view is
2N/A (See the <
span class="command"><
strong>dump-file</
strong></
span> option in
2N/A the BIND 9 Administrator Reference Manual.)
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>flush</
code></
strong></
span></
dt>
2N/A Flushes the server's cache.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>flushname</
code></
strong> <
em class="replaceable"><
code>name</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>] </
span></
dt>
2N/A Flushes the given name from the view's DNS cache
2N/A and, if applicable, from the view's nameserver address
2N/A database, bad server cache and SERVFAIL cache.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>flushtree</
code></
strong> <
em class="replaceable"><
code>name</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>] </
span></
dt>
2N/A Flushes the given name, and all of its subdomains,
2N/A from the view's DNS cache, address database,
2N/A bad server cache, and SERVFAIL cache.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>freeze [<
span class="optional"><
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>]</
span>]</
code></
strong></
span></
dt>
2N/A Suspend updates to a dynamic zone. If no zone is
2N/A specified, then all zones are suspended. This allows
2N/A manual edits to be made to a zone normally updated by
2N/A dynamic update. It also causes changes in the
2N/A journal file to be synced into the master file.
2N/A All dynamic update attempts will be refused while
2N/A See also <
span class="command"><
strong>rndc thaw</
strong></
span>.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>halt [<
span class="optional">-p</
span>]</
code></
strong></
span></
dt>
2N/A Stop the server immediately. Recent changes
2N/A made through dynamic update or IXFR are not saved to
2N/A the master files, but will be rolled forward from the
2N/A journal files when the server is restarted.
2N/A If <
code class="option">-p</
code> is specified <
span class="command"><
strong>named</
strong></
span>'s process id is returned.
2N/A This allows an external process to determine when <
span class="command"><
strong>named</
strong></
span>
2N/A had completed halting.
2N/A See also <
span class="command"><
strong>rndc stop</
strong></
span>.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>loadkeys <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>]</
code></
strong></
span></
dt>
2N/A Fetch all DNSSEC keys for the given zone
2N/A from the key directory. If they are within
2N/A their publication period, merge them into the
2N/A zone's DNSKEY RRset. Unlike <
span class="command"><
strong>rndc
2N/A sign</
strong></
span>, however, the zone is not
2N/A immediately re-signed by the new keys, but is
2N/A allowed to incrementally re-sign over time.
2N/A This command requires that the
2N/A <
span class="command"><
strong>auto-dnssec</
strong></
span> zone option
2N/A be set to <
code class="literal">maintain</
code>,
2N/A and also requires the zone to be configured to
2N/A (See "Dynamic Update Policies" in the Administrator
2N/A Reference Manual for more details.)
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>managed-keys <
em class="replaceable"><
code>(status | refresh | sync)</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>]</
code></
strong></
span></
dt>
2N/A When run with the "status" keyword, print the current
2N/A status of the managed-keys database for the specified
2N/A view, or for all views if none is specified. When run
2N/A with the "refresh" keyword, force an immediate refresh
2N/A of all the managed-keys in the specified view, or all
2N/A views. When run with the "sync" keyword, force an
2N/A immediate dump of the managed-keys database to disk (in
2N/A (<
code class="filename"><
em class="replaceable"><
code>viewname</
code></
em>.mkeys</
code>).
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>modzone <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>] <
em class="replaceable"><
code>configuration</
code></
em> </
code></
strong></
span></
dt>
2N/A Modify the configuration of a zone while the server
2N/A is running. This command requires the
2N/A <
span class="command"><
strong>allow-new-zones</
strong></
span> option to be
2N/A set to <
strong class="userinput"><
code>yes</
code></
strong>. As with
2N/A <
span class="command"><
strong>addzone</
strong></
span>, the
2N/A <
em class="replaceable"><
code>configuration</
code></
em> string
2N/A specified on the command line is the zone
2N/A configuration text that would ordinarily be
2N/A If the zone was originally added via
2N/A <
span class="command"><
strong>rndc addzone</
strong></
span>, the configuration
2N/A changes will be recorded permanently and will still be
2N/A in effect after the server is restarted or reconfigured.
2N/A However, if it was originally configured in
2N/A configuration is still in place; when the server is
2N/A restarted or reconfigured, the zone will revert to
2N/A its original configuration. To make the changes
2N/A permanent, it must also be modified in
2N/A See also <
span class="command"><
strong>rndc addzone</
strong></
span> and <
span class="command"><
strong>rndc delzone</
strong></
span>.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>notify <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>]</
code></
strong></
span></
dt>
2N/A Resend NOTIFY messages for the zone.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>notrace</
code></
strong></
span></
dt>
2N/A Sets the server's debugging level to 0.
2N/A See also <
span class="command"><
strong>rndc trace</
strong></
span>.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>nta
2N/A [<
span class="optional">( -d | -f | -r | -l <
em class="replaceable"><
code>duration</
code></
em>)</
span>]
2N/A <
em class="replaceable"><
code>domain</
code></
em>
2N/A [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]
2N/A </
code></
strong></
span></
dt>
2N/A Sets a DNSSEC negative trust anchor (NTA)
2N/A for <
code class="option">domain</
code>, with a lifetime of
2N/A <
code class="option">duration</
code>. The default lifetime is
2N/A <
code class="option">nta-lifetime</
code> option, and defaults to
2N/A one hour. The lifetime cannot exceed one week.
2N/A A negative trust anchor selectively disables
2N/A DNSSEC validation for zones that are known to be
2N/A failing because of misconfiguration rather than
2N/A an attack. When data to be validated is
2N/A at or below an active NTA (and above any other
2N/A configured trust anchors), <
span class="command"><
strong>named</
strong></
span> will
2N/A abort the DNSSEC validation process and treat the data as
2N/A insecure rather than bogus. This continues until the
2N/A NTA's lifetime is elapsed.
2N/A NTAs persist across restarts of the <
span class="command"><
strong>named</
strong></
span> server.
2N/A The NTAs for a view are saved in a file called
2N/A <
code class="filename"><
em class="replaceable"><
code>name</
code></
em>.nta</
code>,
2N/A where <
em class="replaceable"><
code>name</
code></
em> is the
2N/A name of the view, or if it contains characters
2N/A that are incompatible with use as a file name, a
2N/A cryptographic hash generated from the name
2N/A An existing NTA can be removed by using the
2N/A <
code class="option">-remove</
code> option.
2N/A An NTA's lifetime can be specified with the
2N/A <
code class="option">-lifetime</
code> option. TTL-style
2N/A suffixes can be used to specify the lifetime in
2N/A seconds, minutes, or hours. If the specified NTA
2N/A already exists, its lifetime will be updated to the
2N/A new value. Setting <
code class="option">lifetime</
code> to zero
2N/A is equivalent to <
code class="option">-remove</
code>.
2N/A If <
code class="option">-dump</
code> is used, any other arguments
2N/A are ignored, and a list of existing NTAs is printed
2N/A (note that this may include NTAs that are expired but
2N/A have not yet been cleaned up).
2N/A Normally, <
span class="command"><
strong>named</
strong></
span> will periodically
2N/A test to see whether data below an NTA can now be
2N/A validated (see the <
code class="option">nta-recheck</
code> option
2N/A in the Administrator Reference Manual for details).
2N/A If data can be validated, then the NTA is regarded as
2N/A no longer necessary, and will be allowed to expire
2N/A early. The <
code class="option">-force</
code> overrides this
2N/A behavior and forces an NTA to persist for its entire
2N/A lifetime, regardless of whether data could be
2N/A validated if the NTA were not present.
2N/A All of these options can be shortened,
i.e., to
2N/A <
code class="option">-l</
code>, <
code class="option">-r</
code>, <
code class="option">-d</
code>,
2N/A and <
code class="option">-f</
code>.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>querylog</
code></
strong> [<
span class="optional">on|off</
span>] </
span></
dt>
2N/A Enable or disable query logging. (For backward
2N/A compatibility, this command can also be used without
2N/A an argument to toggle query logging on and off.)
2N/A Query logging can also be enabled
2N/A by explicitly directing the <
span class="command"><
strong>queries</
strong></
span>
2N/A <
span class="command"><
strong>category</
strong></
span> to a
2N/A <
span class="command"><
strong>channel</
strong></
span> in the
2N/A <
span class="command"><
strong>logging</
strong></
span> section of
2N/A <
span class="command"><
strong>querylog yes;</
strong></
span> in the
2N/A <
span class="command"><
strong>options</
strong></
span> section of
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>reconfig</
code></
strong></
span></
dt>
2N/A Reload the configuration file and load new zones,
2N/A but do not reload existing zone files even if they
2N/A This is faster than a full <
span class="command"><
strong>reload</
strong></
span> when there
2N/A is a large number of zones because it avoids the need
2N/A modification times of the zones files.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>recursing</
code></
strong></
span></
dt>
2N/A Dump the list of queries <
span class="command"><
strong>named</
strong></
span> is currently
2N/A recursing on, and the list of domains to which iterative
2N/A queries are currently being sent. (The second list includes
2N/A the number of fetches currently active for the given domain,
2N/A and how many have been passed or dropped because of the
2N/A <
code class="option">fetches-per-zone</
code> option.)
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>refresh <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>]</
code></
strong></
span></
dt>
2N/A Schedule zone maintenance for the given zone.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>reload</
code></
strong></
span></
dt>
2N/A Reload configuration file and zones.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>reload <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>]</
code></
strong></
span></
dt>
2N/A Reload the given zone.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>retransfer <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>]</
code></
strong></
span></
dt>
2N/A Retransfer the given slave zone from the master server.
2N/A If the zone is configured to use
2N/A <
span class="command"><
strong>inline-signing</
strong></
span>, the signed
2N/A version of the zone is discarded; after the
2N/A retransfer of the unsigned version is complete, the
2N/A signed version will be regenerated with all new
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>scan</
code></
strong></
span></
dt>
2N/A Scan the list of available network interfaces
2N/A for changes, without performing a full
2N/A <
span class="command"><
strong>reconfig</
strong></
span> or waiting for the
2N/A <
span class="command"><
strong>interface-interval</
strong></
span> timer.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>secroots [<
span class="optional">-</
span>] [<
span class="optional"><
em class="replaceable"><
code>view ...</
code></
em></
span>]</
code></
strong></
span></
dt>
2N/A Dump the server's security roots and negative trust anchors
2N/A for the specified views. If no view is specified, all views
2N/A If the first argument is "-", then the output is
2N/A returned via the <
span class="command"><
strong>rndc</
strong></
span> response channel
2N/A and printed to the standard output.
2N/A Otherwise, it is written to the secroots dump file, which
2N/A overridden via the <
code class="option">secroots-file</
code> option in
2N/A See also <
span class="command"><
strong>rndc managed-keys</
strong></
span>.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>showzone <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>] </
code></
strong></
span></
dt>
2N/A Print the configuration of a running zone.
2N/A See also <
span class="command"><
strong>rndc zonestatus</
strong></
span>.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>sign <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>]</
code></
strong></
span></
dt>
2N/A Fetch all DNSSEC keys for the given zone
2N/A from the key directory (see the
2N/A <
span class="command"><
strong>key-directory</
strong></
span> option in
2N/A the BIND 9 Administrator Reference Manual). If they are within
2N/A their publication period, merge them into the
2N/A zone's DNSKEY RRset. If the DNSKEY RRset
2N/A is changed, then the zone is automatically
2N/A re-signed with the new key set.
2N/A This command requires that the
2N/A <
span class="command"><
strong>auto-dnssec</
strong></
span> zone option be set
2N/A to <
code class="literal">allow</
code> or
2N/A <
code class="literal">maintain</
code>,
2N/A and also requires the zone to be configured to
2N/A (See "Dynamic Update Policies" in the Administrator
2N/A Reference Manual for more details.)
2N/A See also <
span class="command"><
strong>rndc loadkeys</
strong></
span>.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>signing [<
span class="optional">( -list | -clear <
em class="replaceable"><
code>
keyid/
algorithm</
code></
em> | -clear <
code class="literal">all</
code> | -nsec3param ( <
em class="replaceable"><
code>parameters</
code></
em> | <
code class="literal">none</
code> ) | -serial <
em class="replaceable"><
code>value</
code></
em> ) </
span>] <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>] </
code></
strong></
span></
dt>
2N/A List, edit, or remove the DNSSEC signing state records
2N/A for the specified zone. The status of ongoing DNSSEC
2N/A operations (such as signing or generating
2N/A NSEC3 chains) is stored in the zone in the form
2N/A of DNS resource records of type
2N/A <
span class="command"><
strong>sig-signing-type</
strong></
span>.
2N/A <
span class="command"><
strong>rndc signing -list</
strong></
span> converts
2N/A these records into a human-readable form,
2N/A indicating which keys are currently signing
2N/A or have finished signing the zone, and which NSEC3
2N/A chains are being created or removed.
2N/A <
span class="command"><
strong>rndc signing -clear</
strong></
span> can remove
2N/A a single key (specified in the same format that
2N/A <
span class="command"><
strong>rndc signing -list</
strong></
span> uses to
2N/A display it), or all keys. In either case, only
2N/A completed keys are removed; any record indicating
2N/A that a key has not yet finished signing the zone
2N/A <
span class="command"><
strong>rndc signing -nsec3param</
strong></
span> sets
2N/A the NSEC3 parameters for a zone. This is the
2N/A only supported mechanism for using NSEC3 with
2N/A <
span class="command"><
strong>inline-signing</
strong></
span> zones.
2N/A Parameters are specified in the same format as
2N/A an NSEC3PARAM resource record: hash algorithm,
2N/A flags, iterations, and salt, in that order.
2N/A Currently, the only defined value for hash algorithm
2N/A is <
code class="literal">1</
code>, representing SHA-1.
2N/A The <
code class="option">flags</
code> may be set to
2N/A <
code class="literal">0</
code> or <
code class="literal">1</
code>,
2N/A depending on whether you wish to set the opt-out
2N/A bit in the NSEC3 chain. <
code class="option">iterations</
code>
2N/A defines the number of additional times to apply
2N/A the algorithm when generating an NSEC3 hash. The
2N/A <
code class="option">salt</
code> is a string of data expressed
2N/A in hexadecimal, a hyphen (`-') if no salt is
2N/A to be used, or the keyword <
code class="literal">auto</
code>,
2N/A which causes <
span class="command"><
strong>named</
strong></
span> to generate a
2N/A So, for example, to create an NSEC3 chain using
2N/A the SHA-1 hash algorithm, no opt-out flag,
2N/A 10 iterations, and a salt value of "FFFF", use:
2N/A <
span class="command"><
strong>rndc signing -nsec3param 1 0 10 FFFF <
em class="replaceable"><
code>zone</
code></
em></
strong></
span>.
2N/A To set the opt-out flag, 15 iterations, and no
2N/A <
span class="command"><
strong>rndc signing -nsec3param 1 1 15 - <
em class="replaceable"><
code>zone</
code></
em></
strong></
span>.
2N/A <
span class="command"><
strong>rndc signing -nsec3param none</
strong></
span>
2N/A removes an existing NSEC3 chain and replaces it
2N/A <
span class="command"><
strong>rndc signing -serial value</
strong></
span> sets
2N/A the serial number of the zone to value. If the value
2N/A would cause the serial number to go backwards it will
2N/A be rejected. The primary use is to set the serial on
2N/A inline signed zones.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>stats</
code></
strong></
span></
dt>
2N/A Write server statistics to the statistics file.
2N/A (See the <
span class="command"><
strong>statistics-file</
strong></
span> option in
2N/A the BIND 9 Administrator Reference Manual.)
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>status</
code></
strong></
span></
dt>
2N/A Display status of the server.
2N/A Note that the number of zones includes the internal <
span class="command"><
strong>
bind/
CH</
strong></
span> zone
2N/A and the default <
span class="command"><
strong>/
IN</
strong></
span>
2N/A hint zone if there is not an
2N/A explicit root zone configured.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>stop [<
span class="optional">-p</
span>]</
code></
strong></
span></
dt>
2N/A Stop the server, making sure any recent changes
2N/A made through dynamic update or IXFR are first saved to
2N/A the master files of the updated zones.
2N/A If <
code class="option">-p</
code> is specified <
span class="command"><
strong>named</
strong></
span>'s process id is returned.
2N/A This allows an external process to determine when <
span class="command"><
strong>named</
strong></
span>
2N/A had completed stopping.
2N/A<
p>See also <
span class="command"><
strong>rndc halt</
strong></
span>.</
p>
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>sync [<
span class="optional">-clean</
span>] [<
span class="optional"><
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>]</
span>]</
code></
strong></
span></
dt>
2N/A Sync changes in the journal file for a dynamic zone
2N/A to the master file. If the "-clean" option is
2N/A specified, the journal file is also removed. If
2N/A no zone is specified, then all zones are synced.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>thaw [<
span class="optional"><
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>]</
span>]</
code></
strong></
span></
dt>
2N/A Enable updates to a frozen dynamic zone. If no
2N/A zone is specified, then all frozen zones are
2N/A enabled. This causes the server to reload the zone
2N/A from disk, and re-enables dynamic updates after the
2N/A load has completed. After a zone is thawed,
2N/A dynamic updates will no longer be refused. If
2N/A the zone has changed and the
2N/A <
span class="command"><
strong>ixfr-from-differences</
strong></
span> option is
2N/A in use, then the journal file will be updated to
2N/A reflect changes in the zone. Otherwise, if the
2N/A zone has changed, any existing journal file will be
2N/A<
p>See also <
span class="command"><
strong>rndc freeze</
strong></
span>.</
p>
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>trace</
code></
strong></
span></
dt>
2N/A Increment the servers debugging level by one.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>trace <
em class="replaceable"><
code>level</
code></
em></
code></
strong></
span></
dt>
2N/A Sets the server's debugging level to an explicit
2N/A See also <
span class="command"><
strong>rndc notrace</
strong></
span>.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>tsig-delete</
code></
strong> <
em class="replaceable"><
code>keyname</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span></
dt>
2N/A Delete a given TKEY-negotiated key from the server.
2N/A (This does not apply to statically configured TSIG
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>tsig-list</
code></
strong></
span></
dt>
2N/A List the names of all TSIG keys currently configured
2N/A for use by <
span class="command"><
strong>named</
strong></
span> in each view. The
2N/A list both statically configured keys and dynamic
2N/A TKEY-negotiated keys.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>validation ( on | off | check ) [<
span class="optional"><
em class="replaceable"><
code>view ...</
code></
em></
span>] </
code></
strong></
span></
dt>
2N/A Enable, disable, or check the current status of
2N/A Note <
span class="command"><
strong>dnssec-enable</
strong></
span> also needs to be
2N/A set to <
strong class="userinput"><
code>yes</
code></
strong> or
2N/A <
strong class="userinput"><
code>auto</
code></
strong> to be effective.
2N/A It defaults to enabled.
2N/A<
dt><
span class="term"><
strong class="userinput"><
code>zonestatus <
em class="replaceable"><
code>zone</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>class</
code></
em> [<
span class="optional"><
em class="replaceable"><
code>view</
code></
em></
span>]</
span>]</
code></
strong></
span></
dt>
2N/A Displays the current status of the given zone,
2N/A including the master file name and any include
2N/A files from which it was loaded, when it was most
2N/A recently loaded, the current serial number, the
2N/A number of nodes, whether the zone supports
2N/A dynamic updates, whether the zone is DNSSEC
2N/A signed, whether it uses automatic DNSSEC key
2N/A management or inline signing, and the scheduled
2N/A refresh or expiry times for the zone.
2N/A See also <
span class="command"><
strong>rndc showzone</
strong></
span>.
2N/A<
div class="refsection">
2N/A<
a name="id-1.14.27.10"></
a><
h2>LIMITATIONS</
h2>
2N/A There is currently no way to provide the shared secret for a
2N/A <
code class="option">key_id</
code> without using the configuration file.
2N/A Several error messages could be clearer.
2N/A<
div class="refsection">
2N/A<
a name="id-1.14.27.11"></
a><
h2>SEE ALSO</
h2>
2N/A<
p><
span class="citerefentry"><
span class="refentrytitle">
rndc.conf</
span>(5)</
span>,
2N/A <
span class="citerefentry"><
span class="refentrytitle">rndc-confgen</
span>(8)</
span>,
2N/A <
span class="citerefentry"><
span class="refentrytitle">named</
span>(8)</
span>,
2N/A <
span class="citerefentry"><
span class="refentrytitle">
named.conf</
span>(5)</
span>,
2N/A <
span class="citerefentry"><
span class="refentrytitle">ndc</
span>(8)</
span>,
2N/A <
em class="citetitle">BIND 9 Administrator Reference Manual</
em>.
2N/A<
div class="navfooter">
2N/A<
table width="100%" summary="Navigation footer">
2N/A<
td width="40%" align="left">
2N/A<
td width="40%" align="left" valign="top">
2N/A<
span class="application">nsupdate</
span>�</
td>
2N/A<
td width="20%" align="center"><
a accesskey="h" href="Bv9ARM.html">Home</
a></
td>
2N/A<
td width="40%" align="right" valign="top">�<
code class="filename">
rndc.conf</
code>