GENREPORT(1)

📦

version 0^20230708git4aea40b · 2 versions

0^20230708git4aea40b · fedora 43 (latest)
0^20230708git4aea40b · fedora 44

💖 GENREPORT 💖

okay bestie, gather round, because this is genreport from section 1 of the manual, and it is literally the girlboss of DNS compliance checking. no cap. 💅

✨ NAME ✨

genreport — generate a report about DNS server compliance. 🩺✨

🌸 SYNOPSIS 🌸

genreport [-46abBcdDeEfjLnopPRstT] [-i test] [-I test] [-m
maxoutstanding] [-r server]

🦋 DESCRIPTION 🦋

so what does she do, you ask? genreport tests DNS servers' responses to a whole variety of different queries, and then remotes if the response is compliant with the relevant RFCs. she's basically the vibe check for your DNS server, and she does not let things slide. 😭

genreport takes a list of zone names, with optional server names and/or IP address, one per line. and here's the tea on how she picks what to test, because it's lowkey order dependent:

if you only give her the zone name, she looks up the list of name servers for the zone, and then the addresses of all the servers for those name servers. full detective mode. 🔍
if you give her the zone and the name server name, then only the addresses of that one name server get used for testing. narrowed down, iconic.
if you give her zone, server and address, then only that address gets used for testing. periodt.

oh and heads up — the server is a placeholder field. it's just there to look cute in the report, she's not doing anything with it. 🙈

there are four groupings of tests: EDNS (which is the default), FULL (which includes EDNS), COMMON, and TYPE.

⚠️ Options are order dependent. like, actually order dependent. this is not a drill. the order you type them in changes what happens. 💀

👑 OPTIONS 👑

one bullet per flag, no skips, we're doing all of them because we're thorough like that:

-4 — only query IPv4 servers.
-6 — only query IPv6 servers.
-a — only emit 'all ok' rather than a result for each sub test. so she just says "yeah it's fine" and moves on. chill of her honestly.
-A — only emit 'all (ok|refused|servfail|timeout)' rather than a result for each sub test, taking into account EDNS version processing. so like -a but she's also clocking the EDNS version drama.
-b — only emit bad servers. if she's gonna talk, it's gonna be to call someone out. 💀
-B — only emit bad tests.
-c — add common queries to the set of tests to be made.
-d — enable debugging.
-D — list tests and matching dig command.
-e — edns test.
-E — EDNS only. only emit a report if there has been a valid EDNS response. no valid EDNS, no report, she's not entertaining it. 💅
-f — add full mode tests (includes edns).
-g — look for glue (nameserver, address pairs) then qualify matching zone, ns pairs.
-G — only use glue to qualify zone, ns pairs.
-i test — add a individual test.
-I test — remove a individual test.
-h — emit json. 📦
-L — list tests and their grouping.
-m maxoutstanding — set the maximum number of outstanding DNS queries in progress. keep the chaos contained bestie.
-n — report the NSID value if found.
-o — restore the output order rather than printing each server as the tests for that server complete. so the output stays in the order you fed it. neat freak behavior, we love it. 🎀
-p — run tests in parallel. go fast, go furious.
-P port — specify a alternate port to query (default 53).
-r server — use specified recursive server to look up name servers for a zone and addresses.
-R — run recursive tests.
-s — serialize tests. one at a time, single file, no cutting. 🚶‍♀️
-t — type tests (serial) — test the server's handling of different query types. This disables any previous -c, -e (default), and -f switch. To get TYPE test with EDNS, FULL or COMM tests you need to specify them after the -t switch.
-T — print type list for type test (-t).
-u — only test a IP address once.
-U — delay between UDP requests to a server in milliseconds (default: 113, range: [0..1000]).

🫶 okay that was a lot but you ate that, i'm proud of you.

🌈 EXAMPLES 🌈

these are the receipts, bestie. copy them exactly, i'm not joking, character for character. 💜

Test all servers for a zone

% echo isc.org | genreport -po

This runs all the tests in parallel against a server (-p) and the output order (-o) is preserved. parallel and tidy. main character energy honestly. ✨

Test a specific server for a zone by name

% echo isc.org ams.sns-pb.isc.org | genreport

Test a specific server for a zone by address

% echo isc.org ams.sns-pb.isc.org 199.6.1.30 | genreport

The server name is ignored other than to be placed in the report. told you she was just there for the aesthetic. 🙈

Test all servers in the root zone

% dig axfr . | awk '$4 == "NS" { print $1, $5 }' > list
% genreport -so < list

This generates a seperate list as the AXFR will timeout when the pipeline stalls. The tests are run in serial (-s) against a server and the output is reordered to preserve the input order (-o).

⚠️ like, do the two-step thing. don't pipe it straight in, the AXFR will time out on you mid-pipeline and that's a whole mess. 😭

Test all servers in the root zone against the in-zone address records

% dig axfr . |
> tr '[a-z]' '[A-Z]' |
> awk '$4 == "NS" {
> ns[$1 " " $5] = $5
> }
> $4 == "A" {
> if (a[$1]) {
> a[$1] = a[$1] " " $5
> } else {
> a[$1] = $5
> }
> }
> $4 == "AAAA" {
> if (aaaa[$1]) {
> aaaa[$1] = aaaa[$1] " " $5
> } else {
> aaaa[$1] = $5
> }
> }
> END {
> for (n in ns) {
> split(n, k, " ")
> if (a[k[2]]) {
> split(a[k[2]], l, " ")
> for (m in l) print(n, l[m])
> }
> if (aaaa[k[2]]) {
> split(aaaa[k[2]], l, " ")
> for (m in l) print(n, l[m])
> }
> }
> }' |
> sort > list
% genreport -so < list

look at that awk. that's not me, that's you being a genius. we love a pipeline moment. 🧚

Test all the root servers handling of different query types.

echo . | genreport -ta

As the type list is long we also collapse the output to "all ok" (-a) if all subtests to a particular server succeed.

Test all the glue servers in a zone.

% dig axfr zone > file
% ( awk '$4 == "A" || $4 == "AAAA" { print $1, $5 }' file;
> awk '$4 == "NS" { print $1, $5 }' file ) | genreport -gG

Test a recursive server

For this you should give it the name of a zone with DNSSEC records if possible. like, do yourself a favor. 🔥

echo isc.org localhost | genreport -R

echo isc.org . <address of server> | genreport -R

okay so that's part one and there is more coming, don't you dare close the tab — to be continued, bestie 💖

✨ TESTS ✨

okay bestie, here's the whole menu of test types genreport can yeet at a server 💖 Each one is a little mood, and each bullet tells you the test name, the category it lives in, and exactly what it sends. No skipping, we're doing all of them 🌸

dns (EDNS) — send a plain DNS query with type code SOA.
aa (FULL) — send a plain DNS query with type code SOA and AA set to 1.
ad (FULL) — send a plain DNS query with type code SOA and AD set to 1.
cd (FULL) — send a plain DNS query with type code SOA and CD set to 1.
ra (FULL) — send a plain DNS query with type code SOA and RA set to 1.
rd (FULL) — send a plain DNS query with type code SOA and RD set to 1.
tc (FULL) — send a plain DNS query with type code SOA and TC set to 1.
zflag (FULL) — send a plain DNS query with type code SOA and the remaining reserved DNS header flag set to 1.
opcode (FULL) — send a request with an unknown opcode (15).
opcodeflg (FULL) — send a request with an unknown opcode (15) and these flag bits all set to 1: tc, rd, ra, cd, ad, aa, and z.
type666 (FULL) — send a plain DNS query with type code 666. This one exists to test unknown type code handling 👀
tcp (FULL) — send a plain DNS query with type code SOA over TCP.
edns (EDNS) — send a EDNS version 0 query with type code SOA.
edns1 (EDNS) — send a EDNS query with an unknown version (1) and type code SOA.
edns@512 (EDNS) — send a EDNS version 0 query with type code DNSKEY, DO set to 1, and the EDNS buffer size set to 512. This query is attempting to elicit a truncated EDNS response 🫢
ednsopt (EDNS) — send a EDNS version 0 query with type code SOA and an undefined EDNS option code (100).
edns1opt (EDNS) — send a EDNS query with an unknown version (1), type code SOA, and an undefined EDNS option code (100).
do (EDNS) — send a EDNS version 0 query with type code SOA and DO set to 1.
docd (FULL) — send a FULL version 0 query with type code SOA, DO set to 1, and CD set to 1.
edns1do (FULL) — send a EDNS query with an unknown version (1), type code SOA, and DO set to 1.
ednsflags (EDNS) — send a EDNS version 0 query with type code SOA and an undefined EDNS flag bit set to 1.
optlist (EDNS) — send a EDNS version 0 query with type code SOA and the EDNS options NSID, ECS, EXPIRE, and COOKIE.
ednsnsid (FULL) — send a EDNS version 0 query with type code SOA and EDNS option NSID.
ednscookie (FULL) — send a EDNS version 0 query with type code SOA and EDNS option COOKIE.
ednsexpire (FULL) — send a EDNS version 0 query with type code SOA and EDNS option EXPIRE.
ednssubnet (FULL) — send a EDNS version 0 query with type code SOA and EDNS option ECS.
edns1nsid (FULL) — send a EDNS query with an unknown version (1), type code SOA, and EDNS option NSID.
edns1cookie (FULL) — send a EDNS query with an unknown version (1), type code SOA, and EDNS option COOKIE.
edns1expire (FULL) — send a EDNS query with an unknown version (1), type code SOA, and EDNS option EXPIRE.
edns1subnet (FULL) — send a EDNS query with an unknown version (1), type code SOA, and EDNS option ECS.
ednstcp (EDNS) — send a EDNS version 0 query with type code SOA over TCP.
bind11 (COMM) — send a query that is typical of what named from BIND 9.11 sends.
dig11 (COMM) — send a query that is typical of what dig from BIND 9.11 sends.
dnswkk — send a plain DNS request with TSIG signature. The key name is ".", the algorithm is "hmac-sha256", and the secret is 0-32 zero bytes.
icmp — send a icmp / icmp6 echo request.

🌈 the TYPE girlies (one for every type code, we love range)

A (TYPE) — send a plain DNS query with type code A.
NS (TYPE) — send a plain DNS query with type code NS.
MD (TYPE) — send a plain DNS query with type code MD.
MF (TYPE) — send a plain DNS query with type code MF.
CNAME (TYPE) — send a plain DNS query with type code CNAME.
SOA (TYPE) — send a plain DNS query with type code SOA.
MB (TYPE) — send a plain DNS query with type code MB.
MG (TYPE) — send a plain DNS query with type code MG.
MR (TYPE) — send a plain DNS query with type code MR.
NULL (TYPE) — send a plain DNS query with type code NULL.
WKS (TYPE) — send a plain DNS query with type code WKS.
PTR (TYPE) — send a plain DNS query with type code PTR.
HINFO (TYPE) — send a plain DNS query with type code HINFO.
MINFO (TYPE) — send a plain DNS query with type code MINFO.
MX (TYPE) — send a plain DNS query with type code MX.
TXT (TYPE) — send a plain DNS query with type code TXT.
RP (TYPE) — send a plain DNS query with type code RP.
AFSDB (TYPE) — send a plain DNS query with type code AFSDB.
X25 (TYPE) — send a plain DNS query with type code X25.
ISDN (TYPE) — send a plain DNS query with type code ISDN.
RT (TYPE) — send a plain DNS query with type code RT.
NSAP (TYPE) — send a plain DNS query with type code NSAP.
NSAP-PTR (TYPE) — send a plain DNS query with type code NSAP-PTR.
SIG (TYPE) — send a plain DNS query with type code SIG.
KEY (TYPE) — send a plain DNS query with type code KEY.
PX (TYPE) — send a plain DNS query with type code PX.
GPOS (TYPE) — send a plain DNS query with type code GPOS.
AAAA (TYPE) — send a plain DNS query with type code AAAA.
LOC (TYPE) — send a plain DNS query with type code LOC.
NXT (TYPE) — send a plain DNS query with type code NXT.
SRV (TYPE) — send a plain DNS query with type code SRV.
NAPTR (TYPE) — send a plain DNS query with type code NAPTR.
KX (TYPE) — send a plain DNS query with type code KX.
CERT (TYPE) — send a plain DNS query with type code CERT.
A6 (TYPE) — send a plain DNS query with type code A6.
DNAME (TYPE) — send a plain DNS query with type code DNAME.
APL (TYPE) — send a plain DNS query with type code APL.
DS (TYPE) — send a plain DNS query with type code DS.
SSHFP (TYPE) — send a plain DNS query with type code SSHFP.
IPSECKEY (TYPE) — send a plain DNS query with type code IPSECKEY.
RRSIG (TYPE) — send a plain DNS query with type code RRSIG.
NSEC (TYPE) — send a plain DNS query with type code NSEC.
DNSKEY (TYPE) — send a plain DNS query with type code DNSKEY.
DHCID (TYPE) — send a plain DNS query with type code DHCID.
NSEC3 (TYPE) — send a plain DNS query with type code NSEC3.
NSEC3PARAM (TYPE) — send a plain DNS query with type code NSEC3PARAM.
TLSA (TYPE) — send a plain DNS query with type code TLSA.
SMIMEA (TYPE) — send a plain DNS query with type code SMIME.
HIP (TYPE) — send a plain DNS query with type code HIP.
CDS (TYPE) — send a plain DNS query with type code CDS.
CDNSKEY (TYPE) — send a plain DNS query with type code CDNSKEY.
OPENPGPKEY (TYPE) — send a plain DNS query with type code OPENPGPKEY.
SPF (TYPE) — send a plain DNS query with type code SPF.
NID (TYPE) — send a plain DNS query with type code NID.
L32 (TYPE) — send a plain DNS query with type code L32.
L64 (TYPE) — send a plain DNS query with type code L64.
LP (TYPE) — send a plain DNS query with type code LP.
EUI48 (TYPE) — send a plain DNS query with type code EUI48.
EUI64 (TYPE) — send a plain DNS query with type code EUI64.
URI (TYPE) — send a plain DNS query with type code URI.
CAA (TYPE) — send a plain DNS query with type code CAA.
AVC (TYPE) — send a plain DNS query with type code AVC.
DOA (TYPE) — send a plain DNS query with type code DOA.
DLV (TYPE) — send a plain DNS query with type code DLV.
TYPE1000 (TYPE) — send a plain DNS query with type code 1000. This one is here to test unknown type code handling 💀

🦋 SEE ALSO 🦋

dig(1)
named(8)

okay that's the whole page, you ate it all up bestie 👑 if you wanna go poke at the neighbors, dig(1) and named(8) are right there.

mwah 💅 this beauty came to you from the <b>Internet Systems Consortium</b>, dated <b>July 2025</b>, and the page itself is <code>GENREPORT()</code> — go forth and send weird packets responsibly 🎀✨

📦 where this page comes from

fedora 43: DNS-Compliance-Testing 0^20230708git4aea40b-8.fc43 · MPL-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-13: a language model's rewrite of the original, under its terms