474 lines
17 KiB
Text
474 lines
17 KiB
Text
.\" Man page generated from reStructuredText.
|
|
.
|
|
.
|
|
.nr rst2man-indent-level 0
|
|
.
|
|
.de1 rstReportMargin
|
|
\\$1 \\n[an-margin]
|
|
level \\n[rst2man-indent-level]
|
|
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
-
|
|
\\n[rst2man-indent0]
|
|
\\n[rst2man-indent1]
|
|
\\n[rst2man-indent2]
|
|
..
|
|
.de1 INDENT
|
|
.\" .rstReportMargin pre:
|
|
. RS \\$1
|
|
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
|
|
. nr rst2man-indent-level +1
|
|
.\" .rstReportMargin post:
|
|
..
|
|
.de UNINDENT
|
|
. RE
|
|
.\" indent \\n[an-margin]
|
|
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.nr rst2man-indent-level -1
|
|
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
|
|
..
|
|
.TH "DELV" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
|
|
.SH NAME
|
|
delv \- DNS lookup and validation utility
|
|
.SH SYNOPSIS
|
|
.sp
|
|
\fBdelv\fP [@server] [ [\fB\-4\fP] | [\fB\-6\fP] ] [\fB\-a\fP anchor\-file] [\fB\-b\fP address] [\fB\-c\fP class] [\fB\-d\fP level] [\fB\-i\fP] [\fB\-m\fP] [\fB\-p\fP port#] [\fB\-q\fP name] [\fB\-t\fP type] [\fB\-x\fP addr] [name] [type] [class] [queryopt...]
|
|
.sp
|
|
\fBdelv\fP [\fB\-h\fP]
|
|
.sp
|
|
\fBdelv\fP [\fB\-v\fP]
|
|
.sp
|
|
\fBdelv\fP [queryopt...] [query...]
|
|
.SH DESCRIPTION
|
|
.sp
|
|
\fBdelv\fP is a tool for sending DNS queries and validating the results,
|
|
using the same internal resolver and validator logic as \fI\%named\fP\&.
|
|
.sp
|
|
\fBdelv\fP sends to a specified name server all queries needed to
|
|
fetch and validate the requested data; this includes the original
|
|
requested query, subsequent queries to follow CNAME or DNAME chains,
|
|
queries for DNSKEY, and DS records to establish a chain of trust for
|
|
DNSSEC validation. It does not perform iterative resolution, but
|
|
simulates the behavior of a name server configured for DNSSEC validating
|
|
and forwarding.
|
|
.sp
|
|
By default, responses are validated using the built\-in DNSSEC trust anchor
|
|
for the root zone (\(dq.\(dq). Records returned by \fBdelv\fP are either fully
|
|
validated or were not signed. If validation fails, an explanation of the
|
|
failure is included in the output; the validation process can be traced
|
|
in detail. Because \fBdelv\fP does not rely on an external server to carry
|
|
out validation, it can be used to check the validity of DNS responses in
|
|
environments where local name servers may not be trustworthy.
|
|
.sp
|
|
Unless it is told to query a specific name server, \fBdelv\fP tries
|
|
each of the servers listed in \fB/etc/resolv.conf\fP\&. If no usable server
|
|
addresses are found, \fBdelv\fP sends queries to the localhost
|
|
addresses (127.0.0.1 for IPv4, ::1 for IPv6).
|
|
.sp
|
|
When no command\-line arguments or options are given, \fBdelv\fP
|
|
performs an NS query for \(dq.\(dq (the root zone).
|
|
.SH SIMPLE USAGE
|
|
.sp
|
|
A typical invocation of \fBdelv\fP looks like:
|
|
.INDENT 0.0
|
|
.INDENT 3.5
|
|
.sp
|
|
.EX
|
|
delv @server name type
|
|
.EE
|
|
.UNINDENT
|
|
.UNINDENT
|
|
.sp
|
|
where:
|
|
.INDENT 0.0
|
|
.TP
|
|
.B server
|
|
is the name or IP address of the name server to query. This can be an
|
|
IPv4 address in dotted\-decimal notation or an IPv6 address in
|
|
colon\-delimited notation. When the supplied \fBserver\fP argument is a
|
|
hostname, \fBdelv\fP resolves that name before querying that name
|
|
server (note, however, that this initial lookup is \fInot\fP validated by
|
|
DNSSEC).
|
|
.sp
|
|
If no \fBserver\fP argument is provided, \fBdelv\fP consults
|
|
\fB/etc/resolv.conf\fP; if an address is found there, it queries the
|
|
name server at that address. If either of the \fI\%\-4\fP or \fI\%\-6\fP
|
|
options is in use, then only addresses for the corresponding
|
|
transport are tried. If no usable addresses are found, \fBdelv\fP
|
|
sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1
|
|
for IPv6).
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B name
|
|
is the domain name to be looked up.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B type
|
|
indicates what type of query is required \- ANY, A, MX, etc.
|
|
\fBtype\fP can be any valid query type. If no \fBtype\fP argument is
|
|
supplied, \fBdelv\fP performs a lookup for an A record.
|
|
.UNINDENT
|
|
.SH OPTIONS
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-a anchor\-file
|
|
This option specifies a file from which to read an alternate
|
|
DNSSEC root zone trust anchor.
|
|
.sp
|
|
By default, keys that do not match the root zone name (\fI\&.\fP) are
|
|
ignored. If an alternate key name is desired, it can be
|
|
specified using the \fI\%+root\fP option.
|
|
.sp
|
|
Note: When reading trust anchors, \fBdelv\fP treats
|
|
\fBtrust\-anchors\fP, \fBinitial\-key\fP, and \fBstatic\-key\fP identically. That
|
|
is, for a managed key, it is the \fIinitial\fP key that is trusted;
|
|
\X'tty: link https://datatracker.ietf.org/doc/html/rfc5011.html'\fI\%RFC 5011\fP\X'tty: link' key management is not supported. \fBdelv\fP does not
|
|
consult the managed\-keys database maintained by \fI\%named\fP\&. This
|
|
means that if the default key built in to \fBdelv\fP is revoked,
|
|
\fBdelv\fP must be updated to a newer version in order to continue
|
|
validating.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-b address
|
|
This option sets the source IP address of the query to \fBaddress\fP\&. This must be
|
|
a valid address on one of the host\(aqs network interfaces, or \fB0.0.0.0\fP,
|
|
or \fB::\fP\&. An optional source port may be specified by appending
|
|
\fB#<port>\fP
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-c class
|
|
This option sets the query class for the requested data. Currently, only class
|
|
\(dqIN\(dq is supported in \fBdelv\fP and any other value is ignored.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-d level
|
|
This option sets the systemwide debug level to \fBlevel\fP\&. The allowed range is
|
|
from 0 to 99. The default is 0 (no debugging). Debugging traces from
|
|
\fBdelv\fP become more verbose as the debug level increases. See the
|
|
\fI\%+mtrace\fP, \fI\%+rtrace\fP, and \fI\%+vtrace\fP options below for
|
|
additional debugging details.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-h
|
|
This option displays the \fBdelv\fP help usage output and exits.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-i
|
|
This option sets insecure mode, which disables internal DNSSEC validation. (Note,
|
|
however, that this does not set the CD bit on upstream queries. If the
|
|
server being queried is performing DNSSEC validation, then it does
|
|
not return invalid data; this can cause \fBdelv\fP to time out. When it
|
|
is necessary to examine invalid data to debug a DNSSEC problem, use
|
|
\fI\%dig +cd\fP\&.)
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-m
|
|
This option enables memory usage debugging.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-p port#
|
|
This option specifies a destination port to use for queries, instead of the
|
|
standard DNS port number 53. This option is used with a name
|
|
server that has been configured to listen for queries on a
|
|
non\-standard port number.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-q name
|
|
This option sets the query name to \fBname\fP\&. While the query name can be
|
|
specified without using the \fI\%\-q\fP option, it is sometimes necessary to
|
|
disambiguate names from types or classes (for example, when looking
|
|
up the name \(dqns\(dq, which could be misinterpreted as the type NS, or
|
|
\(dqch\(dq, which could be misinterpreted as class CH).
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-t type
|
|
This option sets the query type to \fBtype\fP, which can be any valid query type
|
|
supported in BIND 9 except for zone transfer types AXFR and IXFR. As
|
|
with \fI\%\-q\fP, this is useful to distinguish query\-name types or classes
|
|
when they are ambiguous. It is sometimes necessary to disambiguate
|
|
names from types.
|
|
.sp
|
|
The default query type is \(dqA\(dq, unless the \fI\%\-x\fP option is supplied
|
|
to indicate a reverse lookup, in which case it is \(dqPTR\(dq.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-v
|
|
This option prints the \fBdelv\fP version and exits.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-x addr
|
|
This option performs a reverse lookup, mapping an address to a name. \fBaddr\fP
|
|
is an IPv4 address in dotted\-decimal notation, or a colon\-delimited
|
|
IPv6 address. When \fI\%\-x\fP is used, there is no need to provide the
|
|
\fBname\fP or \fBtype\fP arguments; \fBdelv\fP automatically performs a
|
|
lookup for a name like \fB11.12.13.10.in\-addr.arpa\fP and sets the
|
|
query type to PTR. IPv6 addresses are looked up using nibble format
|
|
under the IP6.ARPA domain.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-4
|
|
This option forces \fBdelv\fP to only use IPv4.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-6
|
|
This option forces \fBdelv\fP to only use IPv6.
|
|
.UNINDENT
|
|
.SH QUERY OPTIONS
|
|
.sp
|
|
\fBdelv\fP provides a number of query options which affect the way results
|
|
are displayed, and in some cases the way lookups are performed.
|
|
.sp
|
|
Each query option is identified by a keyword preceded by a plus sign
|
|
(\fB+\fP). Some keywords set or reset an option. These may be preceded by
|
|
the string \fBno\fP to negate the meaning of that keyword. Other keywords
|
|
assign values to options like the timeout interval. They have the form
|
|
\fB+keyword=value\fP\&. The query options are:
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +cdflag, +nocdflag
|
|
This option controls whether to set the CD (checking disabled) bit in queries
|
|
sent by \fBdelv\fP\&. This may be useful when troubleshooting DNSSEC
|
|
problems from behind a validating resolver. A validating resolver
|
|
blocks invalid responses, making it difficult to retrieve them
|
|
for analysis. Setting the CD flag on queries causes the resolver
|
|
to return invalid responses, which \fBdelv\fP can then validate
|
|
internally and report the errors in detail.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +class, +noclass
|
|
This option controls whether to display the CLASS when printing a record. The
|
|
default is to display the CLASS.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +hint=FILE, +nohint
|
|
This option specifies a filename from which to load root hints;
|
|
this will be used to find the root name servers when name server
|
|
mode (\fBdelv +ns\fP) is in use. If the option is not specified,
|
|
built\-in root hints will be used.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +ns, +nons
|
|
This option toggles name server mode. When this option is in use,
|
|
the \fBdelv\fP process instantiates a full recursive resolver, and uses
|
|
that to look up the requested query name and type. Turning on this
|
|
option also activates \fB+mtrace\fP, \fB+strace\fP and \fB+rtrace\fP, so that
|
|
every iterative query will be logged, including the full response messages
|
|
from each authoritatve server. These logged messages will be written
|
|
to \fBstdout\fP rather than \fBstderr\fP as usual, so that the full trace
|
|
can be captured more easily.
|
|
.sp
|
|
This is intended to be similar to the behavior of \fBdig +trace\fP, but
|
|
because it uses the same code as \fBnamed\fP, it much more accurately
|
|
replicates the behavior of a recursive name server with a cold cache
|
|
that is processing a recursive query.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +qmin[=MODE], +noqmin
|
|
When used with \fB+ns\fP, this option enables QNAME minimization mode.
|
|
Valid options of MODE are \fBrelaxed\fP and \fBstrict\fP\&. By default,
|
|
QNAME minimization is disabled. If \fB+qmin\fP is specified but MODE
|
|
is omitted, then \fBrelaxed\fP mode will be used.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +ttl, +nottl
|
|
This option controls whether to display the TTL when printing a record. The
|
|
default is to display the TTL.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +rtrace, +nortrace
|
|
This option toggles resolver fetch logging. This reports the name and
|
|
type of each query sent by \fBdelv\fP in the process of carrying
|
|
out the resolution and validation process, including the original query
|
|
and all subsequent queries to follow CNAMEs and to establish a chain of
|
|
trust for DNSSEC validation.
|
|
.sp
|
|
This is equivalent to setting the debug level to 1 in the \(dqresolver\(dq
|
|
logging category. Setting the systemwide debug level to 1 using the
|
|
\fI\%\-d\fP option produces the same output, but affects other
|
|
logging categories as well.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +mtrace, +nomtrace
|
|
This option toggles logging of messages received. This produces
|
|
a detailed dump of the responses received by \fBdelv\fP in the
|
|
process of carrying out the resolution and validation process.
|
|
.sp
|
|
This is equivalent to setting the debug level to 10 for the \(dqpackets\(dq
|
|
module of the \(dqresolver\(dq logging category. Setting the systemwide
|
|
debug level to 10 using the \fI\%\-d\fP option produces the same
|
|
output, but affects other logging categories as well.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +strace, +nostrace
|
|
This option toggles logging of messages sent. This produces a detailed
|
|
dump of the queries sent by \fBdelv\fP in the process of carrying
|
|
out the resolution and validation process. Turning on this option
|
|
also activates \fB+mtrace\fP\&.
|
|
.sp
|
|
This is equivalent to setting the debug level to 11 for the \(dqpackets\(dq
|
|
module of the \(dqresolver\(dq logging category. Setting the systemwide
|
|
debug level to 11 using the \fI\%\-d\fP option produces the same
|
|
output, but affects other logging categories as well.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +vtrace, +novtrace
|
|
This option toggles validation logging. This shows the internal process of the
|
|
validator as it determines whether an answer is validly signed,
|
|
unsigned, or invalid.
|
|
.sp
|
|
This is equivalent to setting the debug level to 3 for the
|
|
\(dqvalidator\(dq module of the \(dqdnssec\(dq logging category. Setting the
|
|
systemwide debug level to 3 using the \fI\%\-d\fP option produces the
|
|
same output, but affects other logging categories as well.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +short, +noshort
|
|
This option toggles between verbose and terse answers. The default is to print the answer in a
|
|
verbose form.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +comments, +nocomments
|
|
This option toggles the display of comment lines in the output. The default is to
|
|
print comments.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +rrcomments, +norrcomments
|
|
This option toggles the display of per\-record comments in the output (for example,
|
|
human\-readable key information about DNSKEY records). The default is
|
|
to print per\-record comments.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +crypto, +nocrypto
|
|
This option toggles the display of cryptographic fields in DNSSEC records. The
|
|
contents of these fields are unnecessary to debug most DNSSEC
|
|
validation failures and removing them makes it easier to see the
|
|
common failures. The default is to display the fields. When omitted,
|
|
they are replaced by the string \fB[omitted]\fP or, in the DNSKEY case, the
|
|
key ID is displayed as the replacement, e.g. \fB[ key id = value ]\fP\&.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +restarts
|
|
When name server mode (\fBdelv +ns\fP) is in use, this option sets the
|
|
maximum number of CNAME queries to follow before terminating resolution.
|
|
This prevents \fBdelv\fP from hanging in the event of a CNAME loop.
|
|
The default is 11.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +maxqueries
|
|
This option specifies the maximum number of queries to send to resolve
|
|
a name before giving up. The default is 50.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +maxtotalqueries
|
|
This option specifies the maximum number of queries to send to resolve
|
|
a client request before giving up. The default is 200.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +trust, +notrust
|
|
This option controls whether to display the trust level when printing a record.
|
|
The default is to display the trust level.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +split[=W], +nosplit
|
|
This option splits long hex\- or base64\-formatted fields in resource records into
|
|
chunks of \fBW\fP characters (where \fBW\fP is rounded up to the nearest
|
|
multiple of 4). \fB+nosplit\fP or \fB+split=0\fP causes fields not to be
|
|
split at all. The default is 56 characters, or 44 characters when
|
|
multiline mode is active.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +all, +noall
|
|
This option sets or clears the display options \fI\%+comments\fP,
|
|
\fI\%+rrcomments\fP, and \fI\%+trust\fP as a group.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +multiline, +nomultiline
|
|
This option prints long records (such as RRSIG, DNSKEY, and SOA records) in a
|
|
verbose multi\-line format with human\-readable comments. The default
|
|
is to print each record on a single line, to facilitate machine
|
|
parsing of the \fBdelv\fP output.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +dnssec, +nodnssec
|
|
This option indicates whether to display RRSIG records in the \fBdelv\fP output.
|
|
The default is to do so. Note that (unlike in \fI\%dig\fP) this does
|
|
\fInot\fP control whether to request DNSSEC records or to
|
|
validate them. DNSSEC records are always requested, and validation
|
|
always occurs unless suppressed by the use of \fI\%\-i\fP or
|
|
\fI\%+noroot\fP\&.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +root[=ROOT], +noroot
|
|
This option indicates whether to perform conventional DNSSEC validation, and if so,
|
|
specifies the name of a trust anchor. The default is to validate using a
|
|
trust anchor of \(dq.\(dq (the root zone), for which there is a built\-in key. If
|
|
specifying a different trust anchor, then \fI\%\-a\fP must be used to specify a
|
|
file containing the key.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +tcp, +notcp
|
|
This option controls whether to use TCP when sending queries. The default is to
|
|
use UDP unless a truncated response has been received.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +unknownformat, +nounknownformat
|
|
This option prints all RDATA in unknown RR\-type presentation format (\X'tty: link https://datatracker.ietf.org/doc/html/rfc3597.html'\fI\%RFC 3597\fP\X'tty: link').
|
|
The default is to print RDATA for known types in the type\(aqs
|
|
presentation format.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B +yaml, +noyaml
|
|
This option prints response data in YAML format.
|
|
.UNINDENT
|
|
.SH FILES
|
|
.sp
|
|
\fB/etc/resolv.conf\fP
|
|
.SH SEE ALSO
|
|
.sp
|
|
\fI\%dig(1)\fP, \fI\%named(8)\fP, \X'tty: link https://datatracker.ietf.org/doc/html/rfc4034.html'\fI\%RFC 4034\fP\X'tty: link', \X'tty: link https://datatracker.ietf.org/doc/html/rfc4035.html'\fI\%RFC 4035\fP\X'tty: link', \X'tty: link https://datatracker.ietf.org/doc/html/rfc4431.html'\fI\%RFC 4431\fP\X'tty: link', \X'tty: link https://datatracker.ietf.org/doc/html/rfc5074.html'\fI\%RFC 5074\fP\X'tty: link', \X'tty: link https://datatracker.ietf.org/doc/html/rfc5155.html'\fI\%RFC 5155\fP\X'tty: link'\&.
|
|
.SH AUTHOR
|
|
Internet Systems Consortium
|
|
.SH COPYRIGHT
|
|
2025, Internet Systems Consortium
|
|
.\" Generated by docutils manpage writer.
|
|
.
|