114 lines
3.9 KiB
Plaintext
114 lines
3.9 KiB
Plaintext
.\" Man page generated from reStructuredText.
|
|
.
|
|
.TH "DNSSEC-VERIFY" "8" "@RELEASE_DATE@" "@BIND9_VERSION@" "BIND 9"
|
|
.SH NAME
|
|
dnssec-verify \- DNSSEC zone verification tool
|
|
.
|
|
.nr rst2man-indent-level 0
|
|
.
|
|
.de1 rstReportMargin
|
|
\\$1 \\n[an-margin]
|
|
level \\n[rst2man-indent-level]
|
|
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
-
|
|
\\n[rst2man-indent0]
|
|
\\n[rst2man-indent1]
|
|
\\n[rst2man-indent2]
|
|
..
|
|
.de1 INDENT
|
|
.\" .rstReportMargin pre:
|
|
. RS \\$1
|
|
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
|
|
. nr rst2man-indent-level +1
|
|
.\" .rstReportMargin post:
|
|
..
|
|
.de UNINDENT
|
|
. RE
|
|
.\" indent \\n[an-margin]
|
|
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.nr rst2man-indent-level -1
|
|
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
|
|
..
|
|
.SH SYNOPSIS
|
|
.sp
|
|
\fBdnssec\-verify\fP [\fB\-c\fP class] [\fB\-E\fP engine] [\fB\-I\fP input\-format] [\fB\-o\fP origin] [\fB\-q\fP] [\fB\-v\fP level] [\fB\-V\fP] [\fB\-x\fP] [\fB\-z\fP] {zonefile}
|
|
.SH DESCRIPTION
|
|
.sp
|
|
\fBdnssec\-verify\fP verifies that a zone is fully signed for each
|
|
algorithm found in the DNSKEY RRset for the zone, and that the NSEC /
|
|
NSEC3 chains are complete.
|
|
.SH OPTIONS
|
|
.INDENT 0.0
|
|
.TP
|
|
\fB\-c\fP class
|
|
Specifies the DNS class of the zone.
|
|
.TP
|
|
\fB\-E\fP engine
|
|
Specifies the cryptographic hardware to use, when applicable.
|
|
.sp
|
|
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
|
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
|
cryptographic accelerator or hardware service module. When BIND is
|
|
built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it
|
|
defaults to the path of the PKCS#11 provider library specified via
|
|
"\-\-with\-pkcs11".
|
|
.TP
|
|
\fB\-I\fP input\-format
|
|
The format of the input zone file. Possible formats are \fB"text"\fP
|
|
(default) and \fB"raw"\fP\&. This option is primarily intended to be used
|
|
for dynamic signed zones so that the dumped zone file in a non\-text
|
|
format containing updates can be verified independently. The use of
|
|
this option does not make much sense for non\-dynamic zones.
|
|
.TP
|
|
\fB\-o\fP origin
|
|
The zone origin. If not specified, the name of the zone file is
|
|
assumed to be the origin.
|
|
.TP
|
|
\fB\-v\fP level
|
|
Sets the debugging level.
|
|
.TP
|
|
\fB\-V\fP
|
|
Prints version information.
|
|
.TP
|
|
.B \fB\-q\fP
|
|
Quiet mode: Suppresses output. Without this option, when \fBdnssec\-verify\fP
|
|
is run it will print to standard output the number of keys in use, the
|
|
algorithms used to verify the zone was signed correctly and other status
|
|
information. With it, all non\-error output is suppressed, and only the exit
|
|
code will indicate success.
|
|
.TP
|
|
\fB\-x\fP
|
|
Only verify that the DNSKEY RRset is signed with key\-signing keys.
|
|
Without this flag, it is assumed that the DNSKEY RRset will be signed
|
|
by all active keys. When this flag is set, it will not be an error if
|
|
the DNSKEY RRset is not signed by zone\-signing keys. This corresponds
|
|
to the \fB\-x\fP option in \fBdnssec\-signzone\fP\&.
|
|
.TP
|
|
\fB\-z\fP
|
|
Ignore the KSK flag on the keys when determining whether the zone if
|
|
correctly signed. Without this flag it is assumed that there will be
|
|
a non\-revoked, self\-signed DNSKEY with the KSK flag set for each
|
|
algorithm and that RRsets other than DNSKEY RRset will be signed with
|
|
a different DNSKEY without the KSK flag set.
|
|
.sp
|
|
With this flag set, we only require that for each algorithm, there
|
|
will be at least one non\-revoked, self\-signed DNSKEY, regardless of
|
|
the KSK flag state, and that other RRsets will be signed by a
|
|
non\-revoked key for the same algorithm that includes the self\-signed
|
|
key; the same key may be used for both purposes. This corresponds to
|
|
the \fB\-z\fP option in \fBdnssec\-signzone\fP\&.
|
|
.TP
|
|
\fBzonefile\fP
|
|
The file containing the zone to be signed.
|
|
.UNINDENT
|
|
.SH SEE ALSO
|
|
.sp
|
|
\fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual, \fI\%RFC 4033\fP\&.
|
|
.SH AUTHOR
|
|
Internet Systems Consortium
|
|
.SH COPYRIGHT
|
|
2020, Internet Systems Consortium
|
|
.\" Generated by docutils manpage writer.
|
|
.
|