DT-DANECHK(1)

💖 DT-DANECHK — the manual, but make it cute 💖

okay bestie, welcome to dt-danechk(1), a user command and honestly? she's a little icon. let's get into it 🎀

---

✨ NAME ✨

dt-danechk — validate TLSA records against SSL certificates. that's the whole job. she checks the vibe between your cert and your DNS. 💅

---

✨ SYNOPSIS ✨

dt-danechk [options] DOMAIN_NAME

one domain name, bestie. that's all she needs from you 🫶

---

✨ DESCRIPTION ✨

so dt-danechk is a diagnostic tool — think of her as your little lab partner 🧚 — and you use her to test whether an SSL/TLS certificate is actually valid against the TLSA record that's published in the DNS. like, do they match? are they giving? she finds out.

for more info on TLSA and DANE, go read RFC 6698. no cap, it's all there 📖✨

---

✨ OPTIONS ✨

• -h, --help — shows you the usage and dips out. very demure, very mindful 🙈
• -l label, --label=label — use this to specify the validation policy label. if you don't pass it, the default validator policy gets used instead. whatever, defaults are fine 💜
• -x proto, --proto proto — specifies the protocol that's associated with the TLSA certificate. the possible values for the proto field are:
  • tcp — TCP protocol
  • udp — UDP protocol
  • sc — SCTP protocol (not supported — she said no thank you 💀)

the default value for proto is tcp. slay 🐝

• -p port, --port=port — specifies the port associated with the TLSA certificate. the default value for port is 443. classic 👑
• -o, --output=<debug-level>:<dest-type>[:<dest-options>] — okay this one's a whole meal, let's break it down:
  • <debug-level> is 1-7, corresponding to syslog levels ALERT-DEBUG
  • <dest-type> is one of file, net, syslog, stderr, stdout
  • <dest-options> depends on <dest-type>:
    • file:<file-name> (opened in append mode)
    • net[:<host-name>:<host-port>] (127.0.0.1:1053)
    • syslog[:facility] (0-23 (default 1 USER))

lowkey a lot of colons but we move ✨

• -s, --sync — perform synchronous lookups. the default is to perform asynchronous lookups. pick your fighter 🥊
• -v FILE, --dnsval-conf=FILE — use this to specify the location of the dnsval.conf configuration file. 📁
• -r FILE, --resolv-conf=FILE — use this to specify the location of the resolv.conf configuration file, which contains the name servers to use for lookups. 🔍
• -i FILE, --root-hints=FILE — use this to specify the location of the root.hints configuration file, containing the root name servers. this is only used when no name server is found, and dt-validate must do recursive lookups itself. dramatic but necessary 💅
• -V, --version — displays the version and exits. bye bestie 👋

---

✨ PRE-REQUISITES ✨

• libval

she needs her little support system, periodt 🫶

---

✨ COPYRIGHT ✨

Copyright 2005-2013 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details. 📜

---

✨ AUTHORS ✨

Suresh Krishnaswamy 👑

---

✨ SEE ALSO ✨

• libval(3)
• dnsval.conf(5)
• http://www.dnssec-tools.org

---

bestie reminder: this page is perl v5.26.2, dated 2016-12-16, and it's from DT-DANECHK(1). go forth and validate those TLSA records, you absolute main character 🌈💖✨