dnssec-checkds

8 BIND9

dnssec-checkds

DNSSEC delegation consistency checking tool

          dnssec-checkds
          -l domain
          -f file
          -d dig path
          -D dsfromkey path
          zone

          dnssec-dsfromkey
          -l domain
          -f file
          -d dig path
          -D dsfromkey path
          zone

`dnssec-checkds` verifies the correctness of Delegation Signer (DS) or DNSSEC Lookaside Validation (DLV) resource records for keys in a specified zone.

-f `file`

- If a `file` is specified, then the zone is read from that file to find the DNSKEY records. If not, then the DNSKEY records for the zone are looked up in the DNS.

-l `domain`

- Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone's parent.

-d `dig path`

- Specifies a path to a `dig` binary. Used for testing.

-D `dsfromkey path`

- Specifies a path to a `dnssec-dsfromkey` binary. Used for testing.

dnssec-dsfromkey

8 ,

dnssec-keygen

8 ,

dnssec-signzone

8 ,