DTCONFCHK(1)

📦
version 2.2.3 · 2 versions
, in fedora 43

💖 DTCONFCHK 💖

okay bestie, gather round, because this is dtconfchk from the User Contributed Perl Documentation section of the manual, and it is literally the vibe-checker for your DNSSEC-Tools config files. let's get into it 🦋

✨ NAME ✨

dtconfchk — Check a DNSSEC-Tools configuration file for sanity 🌸

✨ SYNOPSIS ✨

dtconfchk [options] [config_file]

✨ DESCRIPTION ✨

so what does dtconfchk actually do? it reads a DNSSEC-Tools configuration file and figures out whether all the entries in it are valid. that's it, that's the job. and if you don't hand it a config file? no worries, it'll go verify the system configuration file instead. main character energy, honestly 👑

without any display options, dtconfchk just shows you error messages for whatever problems it found, then hits you with a summary line. the display options can crank the detail up or down depending on how nosy you're feeling about the config file's sanity. and in every single case, the exit code is the count of errors found in the file. periodt 💅

the tests are split into five groups:

  1. key-related checks 🔑
  2. zone-related checks 🌐
  3. path checks 🛣️
  4. rollover checks 🔄
  5. miscellaneous checks 🎀

and yeah, the checks in each of these self-explanatory groups are described below, don't worry.

🚨 important: the default_keyrec configuration entry is not checked. that entry specifies the default keyrec file name, and it isn't necessarily expected to exist in any particular place. so like, it gets a pass. iconic of it.

🍓 Boolean Values

the DNSSEC-Tools configuration file has a bunch of fields that are expected to hold boolean values. the recognized values for booleans are:

true values  - 1, true,  t, yes, y
false values - 0, false, f, no,  n

positive values greater than 1 are recognized as true values, but ngl it probably would be best to just use 1. like, why would you do that to yourself 😭

and text values that aren't in the set above? not valid, bestie. they will translate to false values. sorry not sorry.

the following key-related checks are performed:

  • algorithm — make sure the algorithm field is valid. the acceptable values may be found in the dnssec-keygen man page. 📖
  • ksklength — make sure the ksklength field is valid. the acceptable values may be found in the dnssec-keygen man page. this may also be specified as ksklen.
  • ksklife — make sure the ksklife field is valid. the acceptable values may be found in the defaults.pm man page.
  • zskcount — make sure the zskcount field is valid. the ZSK count must be positive. no zeroes, no negatives, we're being real here.
  • zsklength — make sure the zsklength field is valid. the acceptable values may be found in the dnssec-keygen man page. this may also be specified as zsklen.
  • zsklife — make sure the zsklife field is valid. the acceptable values may be found in the defaults.pm man page.
  • random — make sure the random field is valid. this file must be a character device file. 🔥

the following zone-related checks are performed:

  • endtime — make sure the endtime field is valid. this value is assumed to be in the "+NNNNNN" format. there's a lower limit of two hours. (this is an artificial limit under which it may not make sense to have an end-time.) 🙈

🛣️ Path Checks

path checks get run for several DNSSEC-Tools commands, several BIND commands, and a few miscellaneous files. let's go group by group 💫

the following path checks are performed for DNSSEC-Tools commands:

  • genkrf — make sure the genkrf field is valid. if the filename starts with a /, the file must be a regular executable file.
  • keyarch — make sure the keyarch field is valid. if the filename starts with a /, the file must be a regular executable file.
  • rollchk — make sure the rollchk field is valid. if the filename starts with a /, the file must be a regular executable file.
  • rollctl — make sure the rollctl field is valid. if the filename starts with a /, the file must be a regular executable file.
  • zonesigner — make sure the zonesigner field is valid. if the filename starts with a /, the file must be a regular executable file.

the following path checks are performed for BIND tools:

  • keygen — make sure the keygen field is valid. if the filename starts with a /, the file must be a regular executable file.
  • rndc — make sure the rndc field is valid. if the filename starts with a /, the file must be a regular executable file.
  • zonecheck — make sure the zonecheck field is valid. if the filename starts with a /, the file must be a regular executable file.
  • zonesign — make sure the zonesign field is valid. if the filename starts with a /, the file must be a regular executable file.

the following path checks are performed for miscellaneous files and directories:

  • random — make sure the random field is valid. the file must be a character device file.
  • roll_logfile — make sure the roll_logfile field is a regular file.
  • taresolvconf — make sure the taresolvconf field is a regular file.
  • tatmpdir — make sure the tatmpdir field is a directory. 🎀

🔄 Rollover Daemon Checks

the following checks are performed for rollerd values:

  • autosign — make sure that the autosign flag is a valid boolean.
  • log_tz — make sure the log_tz field is either 'gmt' or 'local'.
  • prog_normal, prog_ksk1 ... prog_ksk7, prog_zsk1 ... prog_zsk4 — make sure that the rollover phase commands are valid paths. each of these fields is a semicolon-separated command list. the file checks are run on the commands to make sure the commands exist and are executable. options and arguments to the commands are ignored, as is the default keyword. 👀
  • roll_loadzone — make sure that the roll_loadzone flag is a valid boolean.
  • roll_logfile — make sure that the log file for the rollerd is valid. if the file exists, it must be a regular file.
  • roll_loglevel — make sure that the logging level for the rollerd is reasonable. the log level must be one of the following text or numeric values:
    • tmi, 1 — Overly verbose informational messages.
    • expire, 3 — A verbose countdown of zone expiration is given.
    • info, 4 — Informational messages.
    • phase, 6 — Current state of zone.
    • err, 8 — Error messages.
    • fatal, 9 — Fatal errors.

specifying a particular log level will causes messages of a higher numeric value to also be displayed. (yes, the original says "causes". we're keeping it fr fr 💀)

  • roll_sleeptime — make sure that the rollerd's sleep-time is reasonable. rollerd's sleep-time must be at least one minute. 😴
  • roll_username — make sure that the username for rollerd is valid. if it's a username, it must be translatable to a uid; if it's a uid, it must translate to a known username.
  • zone_errors — make sure that the zone error count is numeric and 0 or greater.

🌈 NSEC3 Checks

the following checks are performed for NSEC3-related values:

  • nsec3iter — make sure that the nsec3iter iteration count falls within the range used by dnssec-signzone. the current values are from 1 - 65535.
  • nsec3optout — make sure that the nsec3optout flag is a valid boolean.
  • usensec3 — make sure that the usensec3 flag is a valid boolean.

🎀 Miscellaneous Checks

the following miscellaneous checks are performed:

  • admin-email — make sure that the admin-email field is defined and has a value. dtconfchk does not try to validate the email address itself. so put literally anything in there, it's not gonna judge the format 💅
  • archivedir — make sure that the archivedir directory is actually a directory. this check is only performed if the savekeys flag is set on.
  • entropy_msg — make sure that the entropy_msg flag is a valid boolean.
  • savekeys — make sure that the savekeys flag is a valid boolean. if this flag is set to 1, then the archivedir field will also be checked.
  • usegui — make sure that the usegui flag is a valid boolean.
  • zonefile-parser — make sure that the zonefile-parser flag is a valid Perl module. this is checked by using the Perl "require" facility to load the specified module. 📦

✨ OPTIONS ✨

  • -expert — this option will bypass the following checks:
    • KSK has a longer lifespan than the configuration file's default minimum lifespan
    • KSK has a shorter lifespan than the configuration file's default maximum lifespan
    • ZSKs have a longer lifespan than the configuration file's default minimum lifespan
    • ZSKs have a shorter lifespan than the configuration file's default maximum lifespan
  • -quiet — no output will be given. the number of errors will be used as the exit code. silent but deadly 🤫
  • -summary — a final summary of success or failure will be printed. the number of errors will be used as the exit code.
  • -verbose — success or failure status of each check will be given. a + or - prefix will be given for each valid and invalid entry. the number of errors will be used as the exit code. this is the nosy option, and we love her for it 🔍
  • -Version — displays the version information for dtconfchk and the DNSSEC-Tools package.
  • -help — display a usage message.

Copyright 2004-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details.

✨ AUTHOR ✨

Wayne Morrison, tewok@tislabs.com

✨ SEE ALSO ✨

  • dtdefs(8), dtinitconf(8), rollerd(8), zonesigner(8)
  • Net::DNS::SEC::Tools::conf.pm(3), Net::DNS::SEC::Tools::defaults.pm(3)
  • dnssec-tools.conf(5)

and that's the whole page, bestie 🫶 this was perl v5.42.0, dated 2025-07-23, and it's giving manual page, but make it iconic 💖✨ go check your config files, you got this 👑

📦 where this page comes from