January 02, 2013
dnssec-checkds 8 BIND9
dnssec-checkds A DNSSEC delegation consistency checking tool.
2012 2013 2014 Internet Systems Consortium, Inc. ("ISC")
`dnssec-checkds` `-l domain` `-f file` `-d dig path` `-D dsfromkey path` zone `dnssec-dsfromkey` `-l domain` `-f file` `-d dig path` `-D dsfromkey path` zone

## DESCRIPTION

`dnssec-checkds` verifies the correctness of Delegation Signer (DS) or DNSSEC Lookaside Validation (DLV) resource records for keys in a specified zone.

## OPTIONS

-f file

  If a `file` is specified, then the zone is read from that file to find the DNSKEY records. If not, then the DNSKEY records for the zone are looked up in the DNS.

-l domain

  Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone's parent. For example, to check for DLV records for "example.com" in ISC's DLV zone, use: `dnssec-checkds -l dlv.isc.org example.com`

-d dig path

  Specifies a path to a `dig` binary. Used for testing.

-D dsfromkey path

  Specifies a path to a `dnssec-dsfromkey` binary. Used for testing.

## SEE ALSO

dnssec-dsfromkey 8 , dnssec-keygen 8 , dnssec-signzone 8 ,

## AUTHOR

Internet Systems Consortium