diff options
Diffstat (limited to '')
| -rw-r--r-- | doc/man/delv.1in | 411 |
1 files changed, 411 insertions, 0 deletions
diff --git a/doc/man/delv.1in b/doc/man/delv.1in new file mode 100644 index 0000000..05d626c --- /dev/null +++ b/doc/man/delv.1in @@ -0,0 +1,411 @@ +.\" Man page generated from reStructuredText. +. +. +.nr rst2man-indent-level 0 +. +.de1 rstReportMargin +\\$1 \\n[an-margin] +level \\n[rst2man-indent-level] +level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] +- +\\n[rst2man-indent0] +\\n[rst2man-indent1] +\\n[rst2man-indent2] +.. +.de1 INDENT +.\" .rstReportMargin pre: +. RS \\$1 +. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin] +. nr rst2man-indent-level +1 +.\" .rstReportMargin post: +.. +.de UNINDENT +. RE +.\" indent \\n[an-margin] +.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]] +.nr rst2man-indent-level -1 +.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] +.in \\n[rst2man-indent\\n[rst2man-indent-level]]u +.. +.TH "DELV" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9" +.SH NAME +delv \- DNS lookup and validation utility +.SH SYNOPSIS +.sp +\fBdelv\fP [@server] [ [\fB\-4\fP] | [\fB\-6\fP] ] [\fB\-a\fP anchor\-file] [\fB\-b\fP address] [\fB\-c\fP class] [\fB\-d\fP level] [\fB\-i\fP] [\fB\-m\fP] [\fB\-p\fP port#] [\fB\-q\fP name] [\fB\-t\fP type] [\fB\-x\fP addr] [name] [type] [class] [queryopt...] +.sp +\fBdelv\fP [\fB\-h\fP] +.sp +\fBdelv\fP [\fB\-v\fP] +.sp +\fBdelv\fP [queryopt...] [query...] +.SH DESCRIPTION +.sp +\fBdelv\fP is a tool for sending DNS queries and validating the results, +using the same internal resolver and validator logic as \fI\%named\fP\&. +.sp +\fBdelv\fP sends to a specified name server all queries needed to +fetch and validate the requested data; this includes the original +requested query, subsequent queries to follow CNAME or DNAME chains, +queries for DNSKEY, and DS records to establish a chain of trust for +DNSSEC validation. It does not perform iterative resolution, but +simulates the behavior of a name server configured for DNSSEC validating +and forwarding. +.sp +By default, responses are validated using the built\-in DNSSEC trust anchor +for the root zone (\(dq.\(dq). Records returned by \fBdelv\fP are either fully +validated or were not signed. If validation fails, an explanation of the +failure is included in the output; the validation process can be traced +in detail. Because \fBdelv\fP does not rely on an external server to carry +out validation, it can be used to check the validity of DNS responses in +environments where local name servers may not be trustworthy. +.sp +Unless it is told to query a specific name server, \fBdelv\fP tries +each of the servers listed in \fB/etc/resolv.conf\fP\&. If no usable server +addresses are found, \fBdelv\fP sends queries to the localhost +addresses (127.0.0.1 for IPv4, ::1 for IPv6). +.sp +When no command\-line arguments or options are given, \fBdelv\fP +performs an NS query for \(dq.\(dq (the root zone). +.SH SIMPLE USAGE +.sp +A typical invocation of \fBdelv\fP looks like: +.INDENT 0.0 +.INDENT 3.5 +.sp +.nf +.ft C +delv @server name type +.ft P +.fi +.UNINDENT +.UNINDENT +.sp +where: +.INDENT 0.0 +.TP +.B server +is the name or IP address of the name server to query. This can be an +IPv4 address in dotted\-decimal notation or an IPv6 address in +colon\-delimited notation. When the supplied \fBserver\fP argument is a +hostname, \fBdelv\fP resolves that name before querying that name +server (note, however, that this initial lookup is \fInot\fP validated by +DNSSEC). +.sp +If no \fBserver\fP argument is provided, \fBdelv\fP consults +\fB/etc/resolv.conf\fP; if an address is found there, it queries the +name server at that address. If either of the \fI\%\-4\fP or \fI\%\-6\fP +options is in use, then only addresses for the corresponding +transport are tried. If no usable addresses are found, \fBdelv\fP +sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1 +for IPv6). +.UNINDENT +.INDENT 0.0 +.TP +.B name +is the domain name to be looked up. +.UNINDENT +.INDENT 0.0 +.TP +.B type +indicates what type of query is required \- ANY, A, MX, etc. +\fBtype\fP can be any valid query type. If no \fBtype\fP argument is +supplied, \fBdelv\fP performs a lookup for an A record. +.UNINDENT +.SH OPTIONS +.INDENT 0.0 +.TP +.B \-a anchor\-file +This option specifies a file from which to read DNSSEC trust anchors. The default +is \fB@sysconfdir@/bind.keys\fP, which is included with BIND 9 and contains one +or more trust anchors for the root zone (\(dq.\(dq). +.sp +Keys that do not match the root zone name are ignored. An alternate +key name can be specified using the \fI\%+root\fP option. +.sp +Note: When reading the trust anchor file, \fBdelv\fP treats \fBtrust\-anchors\fP, +\fBinitial\-key\fP, and \fBstatic\-key\fP identically. That is, for a managed key, +it is the \fIinitial\fP key that is trusted; \fI\%RFC 5011\fP key management is not +supported. \fBdelv\fP does not consult the managed\-keys database maintained by +\fI\%named\fP, which means that if either of the keys in \fB@sysconfdir@/bind.keys\fP is +revoked and rolled over, \fB@sysconfdir@/bind.keys\fP must be updated to +use DNSSEC validation in \fBdelv\fP\&. +.UNINDENT +.INDENT 0.0 +.TP +.B \-b address +This option sets the source IP address of the query to \fBaddress\fP\&. This must be +a valid address on one of the host\(aqs network interfaces, or \fB0.0.0.0\fP, +or \fB::\fP\&. An optional source port may be specified by appending +\fB#<port>\fP +.UNINDENT +.INDENT 0.0 +.TP +.B \-c class +This option sets the query class for the requested data. Currently, only class +\(dqIN\(dq is supported in \fBdelv\fP and any other value is ignored. +.UNINDENT +.INDENT 0.0 +.TP +.B \-d level +This option sets the systemwide debug level to \fBlevel\fP\&. The allowed range is +from 0 to 99. The default is 0 (no debugging). Debugging traces from +\fBdelv\fP become more verbose as the debug level increases. See the +\fI\%+mtrace\fP, \fI\%+rtrace\fP, and \fI\%+vtrace\fP options below for +additional debugging details. +.UNINDENT +.INDENT 0.0 +.TP +.B \-h +This option displays the \fBdelv\fP help usage output and exits. +.UNINDENT +.INDENT 0.0 +.TP +.B \-i +This option sets insecure mode, which disables internal DNSSEC validation. (Note, +however, that this does not set the CD bit on upstream queries. If the +server being queried is performing DNSSEC validation, then it does +not return invalid data; this can cause \fBdelv\fP to time out. When it +is necessary to examine invalid data to debug a DNSSEC problem, use +\fI\%dig +cd\fP\&.) +.UNINDENT +.INDENT 0.0 +.TP +.B \-m +This option enables memory usage debugging. +.UNINDENT +.INDENT 0.0 +.TP +.B \-p port# +This option specifies a destination port to use for queries, instead of the +standard DNS port number 53. This option is used with a name +server that has been configured to listen for queries on a +non\-standard port number. +.UNINDENT +.INDENT 0.0 +.TP +.B \-q name +This option sets the query name to \fBname\fP\&. While the query name can be +specified without using the \fI\%\-q\fP option, it is sometimes necessary to +disambiguate names from types or classes (for example, when looking +up the name \(dqns\(dq, which could be misinterpreted as the type NS, or +\(dqch\(dq, which could be misinterpreted as class CH). +.UNINDENT +.INDENT 0.0 +.TP +.B \-t type +This option sets the query type to \fBtype\fP, which can be any valid query type +supported in BIND 9 except for zone transfer types AXFR and IXFR. As +with \fI\%\-q\fP, this is useful to distinguish query\-name types or classes +when they are ambiguous. It is sometimes necessary to disambiguate +names from types. +.sp +The default query type is \(dqA\(dq, unless the \fI\%\-x\fP option is supplied +to indicate a reverse lookup, in which case it is \(dqPTR\(dq. +.UNINDENT +.INDENT 0.0 +.TP +.B \-v +This option prints the \fBdelv\fP version and exits. +.UNINDENT +.INDENT 0.0 +.TP +.B \-x addr +This option performs a reverse lookup, mapping an address to a name. \fBaddr\fP +is an IPv4 address in dotted\-decimal notation, or a colon\-delimited +IPv6 address. When \fI\%\-x\fP is used, there is no need to provide the +\fBname\fP or \fBtype\fP arguments; \fBdelv\fP automatically performs a +lookup for a name like \fB11.12.13.10.in\-addr.arpa\fP and sets the +query type to PTR. IPv6 addresses are looked up using nibble format +under the IP6.ARPA domain. +.UNINDENT +.INDENT 0.0 +.TP +.B \-4 +This option forces \fBdelv\fP to only use IPv4. +.UNINDENT +.INDENT 0.0 +.TP +.B \-6 +This option forces \fBdelv\fP to only use IPv6. +.UNINDENT +.SH QUERY OPTIONS +.sp +\fBdelv\fP provides a number of query options which affect the way results +are displayed, and in some cases the way lookups are performed. +.sp +Each query option is identified by a keyword preceded by a plus sign +(\fB+\fP). Some keywords set or reset an option. These may be preceded by +the string \fBno\fP to negate the meaning of that keyword. Other keywords +assign values to options like the timeout interval. They have the form +\fB+keyword=value\fP\&. The query options are: +.INDENT 0.0 +.TP +.B +cdflag, +nocdflag +This option controls whether to set the CD (checking disabled) bit in queries +sent by \fBdelv\fP\&. This may be useful when troubleshooting DNSSEC +problems from behind a validating resolver. A validating resolver +blocks invalid responses, making it difficult to retrieve them +for analysis. Setting the CD flag on queries causes the resolver +to return invalid responses, which \fBdelv\fP can then validate +internally and report the errors in detail. +.UNINDENT +.INDENT 0.0 +.TP +.B +class, +noclass +This option controls whether to display the CLASS when printing a record. The +default is to display the CLASS. +.UNINDENT +.INDENT 0.0 +.TP +.B +ttl, +nottl +This option controls whether to display the TTL when printing a record. The +default is to display the TTL. +.UNINDENT +.INDENT 0.0 +.TP +.B +rtrace, +nortrace +This option toggles resolver fetch logging. This reports the name and type of each +query sent by \fBdelv\fP in the process of carrying out the resolution +and validation process, including the original query +and all subsequent queries to follow CNAMEs and to establish a chain +of trust for DNSSEC validation. +.sp +This is equivalent to setting the debug level to 1 in the \(dqresolver\(dq +logging category. Setting the systemwide debug level to 1 using the +\fI\%\-d\fP option produces the same output, but affects other +logging categories as well. +.UNINDENT +.INDENT 0.0 +.TP +.B +mtrace, +nomtrace +This option toggles message logging. This produces a detailed dump of the +responses received by \fBdelv\fP in the process of carrying out the +resolution and validation process. +.sp +This is equivalent to setting the debug level to 10 for the \(dqpackets\(dq +module of the \(dqresolver\(dq logging category. Setting the systemwide +debug level to 10 using the \fI\%\-d\fP option produces the same +output, but affects other logging categories as well. +.UNINDENT +.INDENT 0.0 +.TP +.B +vtrace, +novtrace +This option toggles validation logging. This shows the internal process of the +validator as it determines whether an answer is validly signed, +unsigned, or invalid. +.sp +This is equivalent to setting the debug level to 3 for the +\(dqvalidator\(dq module of the \(dqdnssec\(dq logging category. Setting the +systemwide debug level to 3 using the \fI\%\-d\fP option produces the +same output, but affects other logging categories as well. +.UNINDENT +.INDENT 0.0 +.TP +.B +short, +noshort +This option toggles between verbose and terse answers. The default is to print the answer in a +verbose form. +.UNINDENT +.INDENT 0.0 +.TP +.B +comments, +nocomments +This option toggles the display of comment lines in the output. The default is to +print comments. +.UNINDENT +.INDENT 0.0 +.TP +.B +rrcomments, +norrcomments +This option toggles the display of per\-record comments in the output (for example, +human\-readable key information about DNSKEY records). The default is +to print per\-record comments. +.UNINDENT +.INDENT 0.0 +.TP +.B +crypto, +nocrypto +This option toggles the display of cryptographic fields in DNSSEC records. The +contents of these fields are unnecessary to debug most DNSSEC +validation failures and removing them makes it easier to see the +common failures. The default is to display the fields. When omitted, +they are replaced by the string \fB[omitted]\fP or, in the DNSKEY case, the +key ID is displayed as the replacement, e.g. \fB[ key id = value ]\fP\&. +.UNINDENT +.INDENT 0.0 +.TP +.B +trust, +notrust +This option controls whether to display the trust level when printing a record. +The default is to display the trust level. +.UNINDENT +.INDENT 0.0 +.TP +.B +split[=W], +nosplit +This option splits long hex\- or base64\-formatted fields in resource records into +chunks of \fBW\fP characters (where \fBW\fP is rounded up to the nearest +multiple of 4). \fB+nosplit\fP or \fB+split=0\fP causes fields not to be +split at all. The default is 56 characters, or 44 characters when +multiline mode is active. +.UNINDENT +.INDENT 0.0 +.TP +.B +all, +noall +This option sets or clears the display options \fI\%+comments\fP, +\fI\%+rrcomments\fP, and \fI\%+trust\fP as a group. +.UNINDENT +.INDENT 0.0 +.TP +.B +multiline, +nomultiline +This option prints long records (such as RRSIG, DNSKEY, and SOA records) in a +verbose multi\-line format with human\-readable comments. The default +is to print each record on a single line, to facilitate machine +parsing of the \fBdelv\fP output. +.UNINDENT +.INDENT 0.0 +.TP +.B +dnssec, +nodnssec +This option indicates whether to display RRSIG records in the \fBdelv\fP output. +The default is to do so. Note that (unlike in \fI\%dig\fP) this does +\fInot\fP control whether to request DNSSEC records or to +validate them. DNSSEC records are always requested, and validation +always occurs unless suppressed by the use of \fI\%\-i\fP or +\fI\%+noroot\fP\&. +.UNINDENT +.INDENT 0.0 +.TP +.B +root[=ROOT], +noroot +This option indicates whether to perform conventional DNSSEC validation, and if so, +specifies the name of a trust anchor. The default is to validate using a +trust anchor of \(dq.\(dq (the root zone), for which there is a built\-in key. If +specifying a different trust anchor, then \fI\%\-a\fP must be used to specify a +file containing the key. +.UNINDENT +.INDENT 0.0 +.TP +.B +tcp, +notcp +This option controls whether to use TCP when sending queries. The default is to +use UDP unless a truncated response has been received. +.UNINDENT +.INDENT 0.0 +.TP +.B +unknownformat, +nounknownformat +This option prints all RDATA in unknown RR\-type presentation format (\fI\%RFC 3597\fP). +The default is to print RDATA for known types in the type\(aqs +presentation format. +.UNINDENT +.INDENT 0.0 +.TP +.B +yaml, +noyaml +This option prints response data in YAML format. +.UNINDENT +.SH FILES +.sp +\fB@sysconfdir@/bind.keys\fP +.sp +\fB/etc/resolv.conf\fP +.SH SEE ALSO +.sp +\fI\%dig(1)\fP, \fI\%named(8)\fP, \fI\%RFC 4034\fP, \fI\%RFC 4035\fP, \fI\%RFC 4431\fP, \fI\%RFC 5074\fP, \fI\%RFC 5155\fP\&. +.SH AUTHOR +Internet Systems Consortium +.SH COPYRIGHT +2023, Internet Systems Consortium +.\" Generated by docutils manpage writer. +. |