external/bsd/bind/dist/bin/delv/delv.html

   1 <!--
   2  - Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
   3  -
   4  - Permission to use, copy, modify, and/or distribute this software for any
   5  - purpose with or without fee is hereby granted, provided that the above
   6  - copyright notice and this permission notice appear in all copies.
   7  -
   8  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
   9  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  10  - AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  11  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  12  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  13  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  14  - PERFORMANCE OF THIS SOFTWARE.
  15 -->
  16
  17 <!-- Id -->
  18 <html>
  19 <head>
  20 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
  21 <title>delv</title>
  22 <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
  23 </head>
  24 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
  25 <a name="man.delv"></a><div class="titlepage"></div>
  26 <div class="refnamediv">
  27 <h2>Name</h2>
  28 <p>delv &#8212; DNS lookup and validation utility</p>
  29 </div>
  30 <div class="refsynopsisdiv">
  31 <h2>Synopsis</h2>
  32 <div class="cmdsynopsis"><p><code class="command">delv</code>  [@server] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>level</code></em></code>] [<code class="option">-i</code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [name] [type] [class] [queryopt...]</p></div>
  33 <div class="cmdsynopsis"><p><code class="command">delv</code>  [<code class="option">-h</code>]</p></div>
  34 <div class="cmdsynopsis"><p><code class="command">delv</code>  [<code class="option">-v</code>]</p></div>
  35 <div class="cmdsynopsis"><p><code class="command">delv</code>  [queryopt...] [query...]</p></div>
  36 </div>
  37 <div class="refsect1" lang="en">
  38 <a name="id2543497"></a><h2>DESCRIPTION</h2>
  39 <p><span><strong class="command">delv</strong></span>
  40       (Domain Entity Lookup &amp; Validation) is a tool for sending
  41       DNS queries and validating the results, using the the same internal
  42       resolver and validator logic as <span><strong class="command">named</strong></span>.
  43     </p>
  44 <p>
  45       <span><strong class="command">delv</strong></span> will send to a specified name server all
  46       queries needed to fetch and validate the requested data; this
  47       includes the original requested query, subsequent queries to follow
  48       CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records
  49       to establish a chain of trust for DNSSEC validation.
  50       It does not perform iterative resolution, but simulates the
  51       behavior of a name server configured for DNSSEC validating and
  52       forwarding.
  53     </p>
  54 <p>
  55       By default, responses are validated using built-in DNSSEC trust
  56       anchors for the root zone (".") and for the ISC DNSSEC lookaside
  57       validation zone ("dlv.isc.org").  Records returned by
  58       <span><strong class="command">delv</strong></span> are either fully validated or
  59       were not signed.  If validation fails, an explanation of
  60       the failure is included in the output; the validation process
  61       can be traced in detail.  Because <span><strong class="command">delv</strong></span> does
  62       not rely on an external server to carry out validation, it can
  63       be used to check the validity of DNS responses in environments
  64       where local name servers may not be trustworthy.
  65     </p>
  66 <p>
  67       Unless it is told to query a specific name server,
  68       <span><strong class="command">delv</strong></span> will try each of the servers listed in
  69       <code class="filename">/etc/resolv.conf</code>. If no usable server
  70       addresses are found, <span><strong class="command">delv</strong></span> will send
  71       queries to the localhost addresses (127.0.0.1 for IPv4, ::1
  72       for IPv6).
  73     </p>
  74 <p>
  75       When no command line arguments or options are given,
  76       <span><strong class="command">delv</strong></span> will perform an NS query for "."
  77       (the root zone).
  78     </p>
  79 </div>
  80 <div class="refsect1" lang="en">
  81 <a name="id2543550"></a><h2>SIMPLE USAGE</h2>
  82 <p>
  83       A typical invocation of <span><strong class="command">delv</strong></span> looks like:
  84       </p>
  85 <pre class="programlisting"> delv @server name type </pre>
  86 <p>
  87       where:
  88
  89       </p>
  90 <div class="variablelist"><dl>
  91 <dt><span class="term"><code class="constant">server</code></span></dt>
  92 <dd>
  93 <p>
  94               is the name or IP address of the name server to query.  This
  95               can be an IPv4 address in dotted-decimal notation or an IPv6
  96               address in colon-delimited notation.  When the supplied
  97               <em class="parameter"><code>server</code></em> argument is a hostname,
  98               <span><strong class="command">delv</strong></span> resolves that name before
  99               querying that name server (note, however, that this
 100               initial lookup is <span class="emphasis"><em>not</em></span> validated
 101               by DNSSEC).
 102             </p>
 103 <p>
 104               If no <em class="parameter"><code>server</code></em> argument is
 105               provided, <span><strong class="command">delv</strong></span> consults
 106               <code class="filename">/etc/resolv.conf</code>; if an
 107               address is found there, it queries the name server at
 108               that address. If either of the <code class="option">-4</code> or
 109               <code class="option">-6</code> options are in use, then
 110               only addresses for the corresponding transport
 111               will be tried.  If no usable addresses are found,
 112               <span><strong class="command">delv</strong></span> will send queries to
 113               the localhost addresses (127.0.0.1 for IPv4,
 114               ::1 for IPv6).
 115             </p>
 116 </dd>
 117 <dt><span class="term"><code class="constant">name</code></span></dt>
 118 <dd><p>
 119               is the domain name to be looked up.
 120             </p></dd>
 121 <dt><span class="term"><code class="constant">type</code></span></dt>
 122 <dd><p>
 123               indicates what type of query is required &#8212;
 124               ANY, A, MX, etc.
 125               <em class="parameter"><code>type</code></em> can be any valid query
 126               type.  If no
 127               <em class="parameter"><code>type</code></em> argument is supplied,
 128               <span><strong class="command">delv</strong></span> will perform a lookup for an
 129               A record.
 130             </p></dd>
 131 </dl></div>
 132 <p>
 133     </p>
 134 </div>
 135 <div class="refsect1" lang="en">
 136 <a name="id2543659"></a><h2>OPTIONS</h2>
 137 <div class="variablelist"><dl>
 138 <dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
 139 <dd>
 140 <p>
 141             Specifies a file from which to read DNSSEC trust anchors.
 142             The default is <code class="filename">/etc/bind.keys</code>, which
 143             is included with <acronym class="acronym">BIND</acronym> 9 and contains
 144             trust anchors for the root zone (".") and for the ISC
 145             DNSSEC lookaside validation zone ("dlv.isc.org").
 146           </p>
 147 <p>
 148             Keys that do not match the root or DLV trust-anchor
 149             names are ignored; these key names can be overridden
 150             using the <code class="option">+dlv=NAME</code> or
 151             <code class="option">+root=NAME</code> options.
 152           </p>
 153 <p>
 154             Note: When reading the trust anchor file,
 155             <span><strong class="command">delv</strong></span> treats <code class="option">managed-keys</code>
 156             statements and <code class="option">trusted-keys</code> statements
 157             identically.  That is, for a managed key, it is the
 158             <span class="emphasis"><em>initial</em></span> key that is trusted; RFC 5011
 159             key management is not supported. <span><strong class="command">delv</strong></span>
 160             will not consult the managed-keys database maintained by
 161             <span><strong class="command">named</strong></span>. This means that if either of the
 162             keys in <code class="filename">/etc/bind.keys</code> is revoked
 163             and rolled over, it will be necessary to update
 164             <code class="filename">/etc/bind.keys</code> to use DNSSEC
 165             validation in <span><strong class="command">delv</strong></span>.
 166           </p>
 167 </dd>
 168 <dt><span class="term">-b  <em class="replaceable"><code>address</code></em></span></dt>
 169 <dd><p>
 170             Sets the source IP address of the query to
 171             <em class="parameter"><code>address</code></em>.  This must be a valid address
 172             on one of the host's network interfaces or "0.0.0.0" or "::".
 173             An optional source port may be specified by appending
 174             "#&lt;port&gt;"
 175           </p></dd>
 176 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 177 <dd><p>
 178             Sets the query class for the requested data. Currently,
 179             only class "IN" is supported in <span><strong class="command">delv</strong></span>
 180             and any other value is ignored.
 181           </p></dd>
 182 <dt><span class="term">-d <em class="replaceable"><code>level</code></em></span></dt>
 183 <dd><p>
 184             Set the systemwide debug level to <code class="option">level</code>.
 185             The allowed range is from 0 to 99.
 186             The default is 0 (no debugging).
 187             Debugging traces from <span><strong class="command">delv</strong></span> become
 188             more verbose as the debug level increases.
 189             See the <code class="option">+mtrace</code>, <code class="option">+rtrace</code>,
 190             and <code class="option">+vtrace</code> options below for additional
 191             debugging details.
 192           </p></dd>
 193 <dt><span class="term">-h</span></dt>
 194 <dd><p>
 195             Display the <span><strong class="command">delv</strong></span> help usage output and exit.
 196           </p></dd>
 197 <dt><span class="term">-i</span></dt>
 198 <dd><p>
 199             Insecure mode. This disables internal DNSSEC validation.
 200             (Note, however, this does not set the CD bit on upstream
 201             queries. If the server being queried is performing DNSSEC
 202             validation, then it will not return invalid data; this
 203             can cause <span><strong class="command">delv</strong></span> to time out. When it
 204             is necessary to examine invalid data to debug a DNSSEC
 205             problem, use <span><strong class="command">dig +cd</strong></span>.)
 206           </p></dd>
 207 <dt><span class="term">-m</span></dt>
 208 <dd><p>
 209             Enables memory usage debugging.
 210           </p></dd>
 211 <dt><span class="term">-p <em class="replaceable"><code>port#</code></em></span></dt>
 212 <dd><p>
 213             Specifies a destination port to use for queries instead of
 214             the standard DNS port number 53.  This option would be used
 215             with a name server that has been configured to listen
 216             for queries on a non-standard port number.
 217           </p></dd>
 218 <dt><span class="term">-q <em class="replaceable"><code>name</code></em></span></dt>
 219 <dd><p>
 220             Sets the query name to <em class="parameter"><code>name</code></em>.
 221             While the query name can be specified without using the
 222             <code class="option">-q</code>, it is sometimes necessary to disambiguate
 223             names from types or classes (for example, when looking up the
 224             name "ns", which could be misinterpreted as the type NS,
 225             or "ch", which could be misinterpreted as class CH).
 226           </p></dd>
 227 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 228 <dd>
 229 <p>
 230             Sets the query type to <em class="parameter"><code>type</code></em>, which
 231             can be any valid query type supported in BIND 9 except
 232             for zone transfer types AXFR and IXFR. As with
 233             <code class="option">-q</code>, this is useful to distinguish
 234             query name type or class when they are ambiguous.
 235             it is sometimes necessary to disambiguate names from types.
 236           </p>
 237 <p>
 238             The default query type is "A", unless the <code class="option">-x</code>
 239             option is supplied to indicate a reverse lookup, in which case
 240             it is "PTR".
 241           </p>
 242 </dd>
 243 <dt><span class="term">-v</span></dt>
 244 <dd><p>
 245             Print the <span><strong class="command">delv</strong></span> version and exit.
 246           </p></dd>
 247 <dt><span class="term">-x <em class="replaceable"><code>addr</code></em></span></dt>
 248 <dd><p>
 249             Performs a reverse lookup, mapping an addresses to
 250             a name.  <em class="parameter"><code>addr</code></em> is an IPv4 address in
 251             dotted-decimal notation, or a colon-delimited IPv6 address.
 252             When <code class="option">-x</code> is used, there is no need to provide
 253             the <em class="parameter"><code>name</code></em> or <em class="parameter"><code>type</code></em>
 254             arguments.  <span><strong class="command">delv</strong></span> automatically performs a
 255             lookup for a name like <code class="literal">11.12.13.10.in-addr.arpa</code>
 256             and sets the query type to PTR.  IPv6 addresses are looked up
 257             using nibble format under the IP6.ARPA domain.
 258           </p></dd>
 259 <dt><span class="term">-4</span></dt>
 260 <dd><p>
 261             Forces <span><strong class="command">delv</strong></span> to only use IPv4.
 262           </p></dd>
 263 <dt><span class="term">-6</span></dt>
 264 <dd><p>
 265             Forces <span><strong class="command">delv</strong></span> to only use IPv6.
 266           </p></dd>
 267 </dl></div>
 268 </div>
 269 <div class="refsect1" lang="en">
 270 <a name="id2544160"></a><h2>QUERY OPTIONS</h2>
 271 <p><span><strong class="command">delv</strong></span>
 272       provides a number of query options which affect the way results are
 273       displayed, and in some cases the way lookups are performed.
 274     </p>
 275 <p>
 276       Each query option is identified by a keyword preceded by a plus sign
 277       (<code class="literal">+</code>).  Some keywords set or reset an
 278       option.  These may be preceded by the string
 279       <code class="literal">no</code> to negate the meaning of that keyword.
 280       Other keywords assign values to options like the timeout interval.
 281       They have the form <code class="option">+keyword=value</code>.
 282       The query options are:
 283
 284       </p>
 285 <div class="variablelist"><dl>
 286 <dt><span class="term"><code class="option">+[no]cdflag</code></span></dt>
 287 <dd><p>
 288               Controls whether to set the CD (checking disabled) bit in
 289               queries sent by <span><strong class="command">delv</strong></span>. This may be useful
 290               when troubleshooting DNSSEC problems from behind a validating
 291               resolver. A validating resolver will block invalid responses,
 292               making it difficult to retrieve them for analysis. Setting
 293               the CD flag on queries will cause the resolver to return
 294               invalid responses, which <span><strong class="command">delv</strong></span> can then
 295               validate internally and report the errors in detail.
 296             </p></dd>
 297 <dt><span class="term"><code class="option">+[no]class</code></span></dt>
 298 <dd><p>
 299               Controls whether to display the CLASS when printing
 300               a record. The default is to display the CLASS.
 301             </p></dd>
 302 <dt><span class="term"><code class="option">+[no]ttl</code></span></dt>
 303 <dd><p>
 304               Controls whether to display the TTL when printing
 305               a record. The default is to display the TTL.
 306             </p></dd>
 307 <dt><span class="term"><code class="option">+[no]rtrace</code></span></dt>
 308 <dd>
 309 <p>
 310               Toggle resolver fetch logging. This reports the
 311               name and type of each query sent by <span><strong class="command">delv</strong></span>
 312               in the process of carrying out the resolution and validation
 313               process: this includes including the original query and
 314               all subsequent queries to follow CNAMEs and to establish a
 315               chain of trust for DNSSEC validation.
 316             </p>
 317 <p>
 318               This is equivalent to setting the debug level to 1 in
 319               the "resolver" logging category. Setting the systemwide
 320               debug level to 1 using the <code class="option">-d</code> option will
 321               product the same output (but will affect other logging
 322               categories as well).
 323             </p>
 324 </dd>
 325 <dt><span class="term"><code class="option">+[no]mtrace</code></span></dt>
 326 <dd>
 327 <p>
 328               Toggle message logging. This produces a detailed dump of
 329               the responses received by <span><strong class="command">delv</strong></span> in the
 330               process of carrying out the resolution and validation process.
 331             </p>
 332 <p>
 333               This is equivalent to setting the debug level to 10
 334               for the the "packets" module of the "resolver" logging
 335               category. Setting the systemwide debug level to 10 using
 336               the <code class="option">-d</code> option will produce the same output
 337               (but will affect other logging categories as well).
 338             </p>
 339 </dd>
 340 <dt><span class="term"><code class="option">+[no]vtrace</code></span></dt>
 341 <dd>
 342 <p>
 343               Toggle validation logging. This shows the internal
 344               process of the validator as it determines whether an
 345               answer is validly signed, unsigned, or invalid.
 346             </p>
 347 <p>
 348               This is equivalent to setting the debug level to 3
 349               for the the "validator" module of the "dnssec" logging
 350               category. Setting the systemwide debug level to 3 using
 351               the <code class="option">-d</code> option will produce the same output
 352               (but will affect other logging categories as well).
 353             </p>
 354 </dd>
 355 <dt><span class="term"><code class="option">+[no]short</code></span></dt>
 356 <dd><p>
 357               Provide a terse answer.  The default is to print the answer in a
 358               verbose form.
 359             </p></dd>
 360 <dt><span class="term"><code class="option">+[no]comments</code></span></dt>
 361 <dd><p>
 362               Toggle the display of comment lines in the output.  The default
 363               is to print comments.
 364             </p></dd>
 365 <dt><span class="term"><code class="option">+[no]rrcomments</code></span></dt>
 366 <dd><p>
 367               Toggle the display of per-record comments in the output (for
 368               example, human-readable key information about DNSKEY records).
 369               The default is to print per-record comments.
 370             </p></dd>
 371 <dt><span class="term"><code class="option">+[no]crypto</code></span></dt>
 372 <dd><p>
 373               Toggle the display of cryptographic fields in DNSSEC records.
 374               The contents of these field are unnecessary to debug most DNSSEC
 375               validation failures and removing them makes it easier to see
 376               the common failures.  The default is to display the fields.
 377               When omitted they are replaced by the string "[omitted]" or
 378               in the DNSKEY case the key id is displayed as the replacement,
 379               e.g. "[ key id = value ]".
 380             </p></dd>
 381 <dt><span class="term"><code class="option">+[no]trust</code></span></dt>
 382 <dd><p>
 383               Controls whether to display the trust level when printing
 384               a record. The default is to display the trust level.
 385             </p></dd>
 386 <dt><span class="term"><code class="option">+[no]split[=W]</code></span></dt>
 387 <dd><p>
 388               Split long hex- or base64-formatted fields in resource
 389               records into chunks of <em class="parameter"><code>W</code></em> characters
 390               (where <em class="parameter"><code>W</code></em> is rounded up to the nearest
 391               multiple of 4).
 392               <em class="parameter"><code>+nosplit</code></em> or
 393               <em class="parameter"><code>+split=0</code></em> causes fields not to be
 394               split at all.  The default is 56 characters, or 44 characters
 395               when multiline mode is active.
 396             </p></dd>
 397 <dt><span class="term"><code class="option">+[no]all</code></span></dt>
 398 <dd><p>
 399               Set or clear the display options
 400               <code class="option">+[no]comments</code>,
 401               <code class="option">+[no]rrcomments</code>, and
 402               <code class="option">+[no]trust</code> as a group.
 403             </p></dd>
 404 <dt><span class="term"><code class="option">+[no]multiline</code></span></dt>
 405 <dd><p>
 406               Print long records (such as RRSIG, DNSKEY, and SOA records)
 407               in a verbose multi-line format with human-readable comments.
 408               The default is to print each record on a single line, to
 409               facilitate machine parsing of the <span><strong class="command">delv</strong></span>
 410               output.
 411             </p></dd>
 412 <dt><span class="term"><code class="option">+[no]dnssec</code></span></dt>
 413 <dd><p>
 414               Indicates whether to display RRSIG records in the
 415               <span><strong class="command">delv</strong></span> output.  The default is to
 416               do so.  Note that (unlike in <span><strong class="command">dig</strong></span>)
 417               this does <span class="emphasis"><em>not</em></span> control whether to
 418               request DNSSEC records or whether to validate them.
 419               DNSSEC records are always requested, and validation
 420               will always occur unless suppressed by the use of
 421               <code class="option">-i</code> or <code class="option">+noroot</code> and
 422               <code class="option">+nodlv</code>.
 423             </p></dd>
 424 <dt><span class="term"><code class="option">+[no]root[=ROOT]</code></span></dt>
 425 <dd><p>
 426               Indicates whether to perform conventional (non-lookaside)
 427               DNSSEC validation, and if so, specifies the
 428               name of a trust anchor.  The default is to validate using
 429               a trust anchor of "." (the root zone), for which there is
 430               a built-in key.  If specifying a different trust anchor,
 431               then <code class="option">-a</code> must be used to specify a file
 432               containing the key.
 433             </p></dd>
 434 <dt><span class="term"><code class="option">+[no]dlv[=DLV]</code></span></dt>
 435 <dd><p>
 436               Indicates whether to perform DNSSEC lookaside validation,
 437               and if so, specifies the name of the DLV trust anchor.
 438               The default is to perform lookaside validation using
 439               a trust anchor of "dlv.isc.org", for which there is a
 440               built-in key.  If specifying a different name, then
 441               <code class="option">-a</code> must be used to specify a file
 442               containing the DLV key.
 443             </p></dd>
 444 </dl></div>
 445 <p>
 446
 447     </p>
 448 </div>
 449 <div class="refsect1" lang="en">
 450 <a name="id2544646"></a><h2>FILES</h2>
 451 <p><code class="filename">/etc/bind.keys</code></p>
 452 <p><code class="filename">/etc/resolv.conf</code></p>
 453 </div>
 454 <div class="refsect1" lang="en">
 455 <a name="id2544661"></a><h2>SEE ALSO</h2>
 456 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
 457       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
 458       <em class="citetitle">RFC4034</em>,
 459       <em class="citetitle">RFC4035</em>,
 460       <em class="citetitle">RFC4431</em>,
 461       <em class="citetitle">RFC5074</em>,
 462       <em class="citetitle">RFC5155</em>.
 463     </p>
 464 </div>
 465 </div></body>
 466 </html>