dnsviz-grok(1)

💖 dnsviz-grok — the group chat edition 💖

okay bestie, listen up: this is the manual page for dnsviz-grok(1), part of the General Commands Manual lineup, and honestly? it's giving diagnostic queen. it reads the receipts from your DNS probes and tells you if your DNS deployment is slaying or flopping. let's get into it 💅

---

✨ NAME ✨

dnsviz-grok — assess diagnostic DNS queries 🩺

---

🎀 SYNOPSIS 🎀

dnsviz grok [ options ] [ domain_name... ]

---

🦋 DESCRIPTION 🦋

so the whole vibe here is: you already ran some diagnostic DNS queries (like, say, with dnsviz-probe(1)), and now you want the tea. dnsviz grok takes those results and assesses the health of the DNS deployments for one or more domain names you point it at. 🫶 the processed results get serialized into JSON so other programs can do programmatic diagnostics or fire off alerts. it's giving automation main character energy.

where does the diagnostic query input come from? either a file you name with -r, or standard input. that's it, those are the options. 🌸

now, which domain names get processed? three ways, bestie:

• pass them as command-line arguments,
• drop them in a file and use the -f option,
• or just imply them from the diagnostic query input.

that last one is the preferred methodology (and the simplest, no cap), and it's super useful — except when your input contains diagnostic queries for multiple domain names and you only want to process a subset of them. then you gotta be explicit. 🙈

the rules, spelled out:

• if -f is not used and no domain names are on the command line, the names to process are extracted from the diagnostic query input.
• if -f is used, then you may not specify names on the command line. periodt.

the domain names you pass in are fully-qualified domain names, like example.com, www.example.com, _443._tcp.example.com, 1.2.0.192.in-addr.arpa, or 8.b.d.0.1.0.0.2.ip6.arpa. and because it's implied that they're fully qualified, you do not need a trailing dot. iconic, honestly. ⭐

---

👑 OPTIONS 👑

• -f, --names-file filename — read names from a file instead of from the command line. one name per line, bestie. 💜 and heads up: if you use this option, you may not specify names on the command line. pick a lane.
• -r, --input-file filename — read the diagnostic query input from the specified file instead of from standard input. 🍓
• -t, --trusted-keys-file filename — use trusted keys from this file when processing diagnostic queries. this overrides the default behavior of using the installed keys for the root zone. 🔥 the format of this file is master zone file format, and it should contain DNSKEY records that correspond to one or more trusted keys for one or more DNS zones. this option may be used multiple times on the command line. go off.
• -a, --algorithms alg[,alg...] — support only the DNSSEC algorithms specified. if you use this option, any algorithms not specified will appear as "unsupported." the status of any RRSIG records corresponding to unsupported algorithms will be unknown. additionally, when a zone has only DS records with unsupported algorithms, the zone is treated as "insecure", assuming the DS records are properly authenticated. 🧚
• -d, --digest-algorithms digest_alg[,digest_alg...] — support only the DNSSEC digest algorithms specified. if you use this option, any digest algorithms not specified will appear as "unsupported." the status of any DS records corresponding to unsupported digest algorithms will be unknown. additionally, when a zone has only DS records with unsupported digest algorithms, the zone is treated as "insecure", assuming the DS records are properly authenticated. 🌈
• --ignore-rfc8624 — ignore errors associated with RFC 8624, DNSSEC algorithm implementation requirements. RFC 8624 designates some DNSSEC signing algorithms and some DS digest algorithms as prohibited ("MUST NOT") or not recommended for validation and/or signing. if you use this option, then no warnings will be issued, and the code will still assess their cryptographic status, rather than ignoring them. 💀 (yes, it still looks at the crypto, it's just not gonna yell at you about the RFC.)
• --ignore-rfc9276 — ignore errors associated with RFC 9276, NSEC3 parameter settings. RFC 9276 specifies that if NSEC3 is used, the iterations count must be 0 and the salt length must be 0. if you use this option, then no warnings will be issued for NSEC3 records that violate this specification. 😌
• -C, --enforce-cookies — enforce DNS cookies strictly. require a server to return a "BADCOOKIE" response when a query contains a COOKIE option with no server cookie or with an invalid server cookie. no half-steppin'. 🍪
• -P, --allow-private — allow private IP addresses for authoritative DNS servers. by default, if the IP address corresponding to an authoritative server is in IP address space designated as "private", it gets flagged as an error. but there are some cases where this is allowed — like, for example, if the diagnostic queries are issued to servers in an experimental environment, that might be permissible. 🧪
• --trust-cdnskey-cds — trust all CDNSKEY and CDS records, even if they are not "signed with a key that is represented in both the current DNSKEY and DS RRsets" (RFC 7344). this is allowed if "the Parent uses the CDS or CDNSKEY RRset for initial enrollment; in that case, the Parent validates the CDS/CDNSKEY through some other means" (RFC 7344). and because there is no way for DNSViz to discover the out-of-band means with which the parent might have validated the CDNSKEY and/or CDS records, this trust is signaled with the use of the --trust-cdnskey-cds command-line option. 🫡
• --multi-signer — don't issue errors for missing KSKs with DS RRs. typically an error is issued if a given DNSKEY is not found in the DNSKEY RRset returned by one or more servers. if --multi-signer is specified, then no error is issued, in the case that 1) the DNSKEY is not signing any non-DNSKEY RRsets (i.e., is a zone-signing key or ZSK) and 2) the DNSKEY corresponds to a DS record in the parent. this corresponds to the Model 2 use case in RFC 8901. 🤝
• -o, --output-file filename — write the output to the specified file instead of to standard output, which is the default. 📝
• -c, --minimize-output — format JSON output minimally instead of "pretty" (i.e., with indentation and newlines). tiny JSON, big energy. 🐜
• -l, --log-level level — display only information at the specified log priority or higher. valid values (in increasing order of priority) are: "error", "warning", "info", and "debug". the default is "debug". 🔍
• -h, --help — display the usage and exit. the classic. 💖

---

🚪 EXIT CODES 🚪

the exit codes are:

0. 0 — program terminated normally. we love a clean exit. ✨
1. 1 — incorrect usage. bestie, the syntax... 😭
2. 2 — required package dependencies were not found. 📦❌
3. 3 — there was an error processing the input or saving the output. 💔
4. 4 — program execution was interrupted, or an unknown error occurred. 💀

---

🔗 SEE ALSO 🔗

dnsviz(1), dnsviz-probe(1), dnsviz-graph(1), dnsviz-print(1), dnsviz-query(1) — go read the whole fam, they're all iconic. 👑

---

that's the whole page, bestie! you're officially grok-fluent 💅

version 0.11.0, dated 26 September 2024 — shoutout to the dnsviz-grok(1) source, mwah, no notes 🫶🎀