dnssec-checkds

8 BIND9

dnssec-checkds

A DNSSEC delegation consistency checking tool.

          dnssec-checkds
          -l domain
          -f file
          -d dig path
          -D dsfromkey path
          zone

          dnssec-dsfromkey
          -l domain
          -f file
          -d dig path
          -D dsfromkey path
          zone

## DESCRIPTION

`dnssec-checkds` verifies the correctness of Delegation Signer (DS) or DNSSEC Lookaside Validation (DLV) resource records for keys in a specified zone.

## OPTIONS

-f `file`

- If a `file` is specified, then the zone is read from that file to find the DNSKEY records. If not, then the DNSKEY records for the zone are looked up in the DNS.

-l `domain`

- Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone's parent. For example, to check for DLV records for "example.com" in ISC's DLV zone, use: `dnssec-checkds -l dlv.isc.org example.com`

-d `dig path`

- Specifies a path to a `dig` binary. Used for testing.

-D `dsfromkey path`

- Specifies a path to a `dnssec-dsfromkey` binary. Used for testing.

## SEE ALSO

dnssec-dsfromkey

8 ,

dnssec-keygen

8 ,

dnssec-signzone

8 ,

## AUTHOR

Internet Systems Consortium