DNSSEC-VERIFY(1)

🦋 dnssec-verify — the DNSSEC zone verification tool (yes, from BIND 9, hi)

okay so bestie, picture this: you've got a zone file, and you need to know if it's actually signed correctly before you go live and embarrass yourself in front of the entire internet. that's the whole gig. 💅

---

✨ NAME ✨

dnssec-verify — the DNSSEC zone verification tool. she checks your work. no cap.

---

🎀 SYNOPSIS 🎀

dnssec-verify [-c class] [-E engine] [-I input-format] [-J filename] [-o
origin] [-q] [-v level] [-V] [-x] [-z] {zonefile}

---

💖 DESCRIPTION 💖

dnssec-verify verifies that a zone is fully signed for each algorithm found in the DNSKEY RRset for the zone, and that the NSEC/NSEC3 chains are complete. that's it, that's the whole vibe check. if your chain has a gap in it, she WILL find it and she WILL tell you. 🔍

---

🌸 OPTIONS 🌸

• -c class — tells her the DNS class of the zone. y'know, in case it's not the usual one.
• -E engine — specifies the cryptographic hardware to use, when applicable.

okay so when BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL engine identifier that drives the cryptographic accelerator or hardware service module (usually pkcs11). hardware crypto girlies rise 🙌

• -I input-format — sets the format of the input zone file. possible formats are text (the default) and raw.

this one is primarily intended for dynamic signed zones, so that the dumped zone file in a non-text format containing updates can be verified independently. it is not useful for non-dynamic zones — so don't come at her with a static zone and a raw file, she'll be like... girl why. 💀

• -J filename — tells dnssec-verify to read the journal from the given file when loading the zone file. journals! the receipts! 📓
• -o origin — indicates the zone origin. if you don't specify it, the name of the zone file is assumed to be the origin. bold assumption of her, honestly, but she's usually right.
• -v level — sets the debugging level. crank it up when you want her to overshare. 🗣️
• -V — prints version information. classic.
• -q — sets quiet mode, which suppresses output.

without this option, when dnssec-verify is run it prints to standard output the number of keys in use, the algorithms used to verify the zone was signed correctly, and other status information. with this option, all non-error output is suppressed, and only the exit code indicates success. silent but deadly, love that for her. 🤫

• -x — verifies only that the DNSKEY RRset is signed with key-signing keys.

without this flag, it is assumed that the DNSKEY RRset is signed by all active keys. when this flag is set, it is not an error if the DNSKEY RRset is not signed by zone-signing keys. this corresponds to the -x option in dnssec-signzone.

• -z — indicates that the KSK flag on the keys should be ignored when determining whether the zone is correctly signed.

without this flag, it is assumed that there is a non-revoked, self-signed DNSKEY with the KSK flag set for each algorithm, and that RRsets other than the DNSKEY RRset are signed with a different DNSKEY without the KSK flag set.

with this flag set, BIND 9 only requires that for each algorithm, there be at least one non-revoked, self-signed DNSKEY, regardless of the KSK flag state, and that other RRsets be signed by a non-revoked key for the same algorithm that includes the self-signed key; the same key may be used for both purposes. this corresponds to the -z option in dnssec-signzone.

• zonefile — indicates the file containing the zone to be signed. (yes, the manpage really says "to be signed" here even though this is the verify tool. she contains multitudes. ✨)

---

🌈 SEE ALSO 🌈

• dnssec-signzone(8)
• the BIND 9 Administrator Reference Manual
• RFC 4033 — https://datatracker.ietf.org/doc/html/rfc4033.html

---

👑 Author 👑

Internet Systems Consortium. icons, honestly.

---

🫶 Copyright 🫶

2026, Internet Systems Consortium

---

and that's the page bestie!! 💜 this was dnssec-verify, from BIND 9, version 9.20.30, dated 2026-10-12 — screenshot it, cite it, live by it. mwah 🎀