DNSSEC-CHECKDS(8)

📦 version 9.16.50, in centos-stream 9

💅 DNSSEC-CHECKDS 💅

okay so bestie, welcome to dnssec-checkds, one of the little helpers that ships with BIND 9 — yes, that BIND 9, the DNS one, the icon. this page is section 8 of the manual (system admin commands), and honestly? she's a niche queen but she does exactly one thing and she slays at it.

✨ NAME ✨

dnssec-checkds — the DNSSEC delegation consistency checking tool. that's it, that's the whole vibe. she checks consistency, she checks delegation, she checks DS records. main character energy tbh 🎀

✨ SYNOPSIS ✨

dnssec-checkds [-ddig path] [-Ddsfromkey path] [-ffile] [-ldomain]
[-sfile] {zone}

so you hand her a {zone} (required, not optional, don't @ me) and she goes off. 🦋

✨ DESCRIPTION ✨

dnssec-checkds verifies the correctness of Delegation Signer (DS) resource records for keys in a specified zone.

literally that's the job. you give her a zone, she makes sure the DS records for the keys in that zone are actually correct. no cap. 🔥

✨ OPTIONS ✨

  • -a algorithm — picks a digest algorithm to use when converting the zone's DNSKEY records into the DS records you'd expect to see. and here's the cute part: you can repeat this option as many times as you want, so multiple records get checked for each DNSKEY record. 💖 the algorithm has to be one of SHA-1, SHA-256, or SHA-384. those values are case insensitive, and the hyphen can be dropped entirely if that's your thing. if you don't specify any algorithm at all, the default is SHA-256. 🫶
  • -f file — if you give her a file, then the zone is read from that file to find the DNSKEY records. if you don't, then the DNSKEY records for the zone get looked up in the DNS instead. file girlie or network girlie, your call. 🌸
  • -s file — names a prepared dsset file — like, the kind dnssec-signzone would generate for you — to use as the source for the DS RRset instead of querying the parent. so you skip the parent entirely, she just reads your little file. prepared and unbothered. 💅
  • -d dig path — points to a dig binary. used for testing. that's it, that's the whole note. 🧚
  • -D dsfromkey path — points to a dnssec-dsfromkey binary. used for testing. same energy as the one above, different binary. 🙈
no extra lore here, bestie — those two path options are literally just for testing and that's all the page says about them.

🌈 SEE ALSO 🌈

(yes, the original list ends with a comma. she's a little quirky like that. keeping it. ⭐)

👑 AUTHOR 👑

Internet Systems Consortium — the actual authors, credited, no notes. 💜

2024, Internet Systems Consortium

okay bestie that's the whole page, you're officially a dnssec-checkds understander 🦋✨ this edition right here is from the BIND 9 manual, page version 9.16.50-RH, dated the same as that copyright — go check some DS records and be iconic 💖💅

📦 where this page comes from