ldns-verifyzone(1)

📦
version 1.9.2 · 12 versions
, in arch rolling

🎀 ldns-verifyzone — the vibe check for your DNSSEC zone 🎀

okay so bestie, listen. this is the ldns-verifyzone(1) page from the General Commands Manual, and it's about a little tool that reads a DNSSEC-signed zone and is like… "hmm, is this actually valid tho?" 💅

✨ NAME ✨

ldns-verify-zone — read a DNSSEC signed zone and verify it. that's it, that's the whole job, and honestly? iconic. 👑

🦋 SYNOPSIS 🦋

ldns-verify-zone ZONEFILE

one whole argument. she's low maintenance. 🫶

🌸 DESCRIPTION 🌸

ldns-verify-zone reads a DNS zone file and verifies it. that's the main character energy right there. ✨

so what actually gets checked? grab a snack:

  • RRSIG resource records get checked against the DNSKEY set at the zone apex. no cap, apex keys are the reference point.
  • Each name is checked for an NSEC(3), if appropriate.
  • if ZONEMD resource records are present, one of them needs to match the zone content. at least one has to line up, bestie. one of them. 🎯

💖 OPTIONS 💖

  • -h — show usage and exit. the "wait, how does this work again" button.
  • -a — apex only. check only the zone apex, nothing else. minimalism. 🧚
  • -e period — signatures may not expire within this period. default: no period is used. so like, no grace window unless you ask for one.
  • -i period — signatures must have been valid at least this long. default: signatures should just be valid now. (yes, that's the default, i'm not making this up 💀)
  • -k file — a file that contains a trusted DNSKEY or DS rr. this option may be given more than once — stack 'em up, girly. 🔥
    • alternatively, if -k is not specified, and a default trust anchor (/etc/trusted-key.key) exists and contains a valid DNSKEY or DS record, it will be used as the trust anchor. built-in bestie behavior.
  • -p [0-100] — only check this percentage of the zone. which names to check is determined randomly (chaotic, love that 🙈). defaults to 100. we love a full sweep.
  • -s — check all signature results, instead of one. without the option, one signature that validates stops error output for the RRset. with the option, all results from signature validations are printed. for spurious RRSIGs, that prints output for the spurious RRSIGs if they are wrong. basically: -s says "show me everything, i can handle it".
  • -S — chase signature(s) to a known key. the network may be accessed to validate the zone's DNSKEYs. this implies -k. ⚠️ yes, it goes online. i said what i said.
  • -t YYYYMMDDhhmmss | [+|-]offset — set the validation time either by an absolute time value or as an offset in seconds from the current time. time travel, but make it DNSSEC. 🕰️
  • -v — show the version and exit.
  • -V number — set the verbosity level (default 3):
    • 0: be silent 🤫
    • 1: print result, and any errors
    • 2: same as 1 for now
    • 3: print result, any errors, and the names that are being checked
    • 4: same as 3 for now
    • 5: print the zone after it has been read, the result, any errors, and the names that are being checked

(yes 2 and 4 are placeholders, they said "for now", we're not gonna fight them about it 💀)

  • -Z — requires a valid ZONEMD RR to be present. when given once, this option will permit verifying only the ZONEMD RR of an unsigned zone. when given more than once, the zone needs to be validly DNSSEC signed as well. escalating commitment, honestly.
  • -ZZZ — when three times a -Z option is given, the ZONEMD RR to be verified is considered "detached" and does not need to have valid signatures. she's off the grid. detached. free. 🦋
💡 periods are given in ISO 8601 duration format: P[n]Y[n]M[n]DT[n]H[n]M[n]S

and one more thing — if no file is given, standard input is read. pipe it in, bestie. 🌈

🍓 FILES 🍓

  • /etc/trusted-key.key — the file from which trusted keys are loaded for signature chasing, when no -k option is given. the default trust anchor. the fallback bestie. 🫶

👑 SEE ALSO 👑

unbound-anchor(8)

💜 AUTHOR 💜

Written by the ldns team as an example for ldns usage. (an example, and it still ate. 🔥)

🌟 REPORTING BUGS 🌟

Report bugs to <dns-team@nlnetlabs.nl>.

Copyright (C) 2008 NLnet Labs. This is free software. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

🚨 like, genuinely no warranty. none. zero. don't come for them if it breaks, they told you fr fr.

okay that's the whole page!! 💖 this was ldns-verifyzone(1) from the General Commands Manual, dated 27 May 2008 — a classic, a legend, a vintage icon. go verify some zones, bestie, and remember: one of your ZONEMDs has to match. periodt. 💅✨🎀

📦 where this page comes from