named-checkzone.html 18.3 KB
Newer Older
1
<!--
Tinderbox User's avatar
Tinderbox User committed
2
 - Copyright (C) 2004-2007, 2009-2014 Internet Systems Consortium, Inc. ("ISC")
Mark Andrews's avatar
regen    
Mark Andrews committed
3
 - Copyright (C) 2000-2002 Internet Software Consortium.
Rob Austein's avatar
regen    
Rob Austein committed
4
 - 
Automatic Updater's avatar
regen    
Automatic Updater committed
5
 - Permission to use, copy, modify, and/or distribute this software for any
6
7
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
Rob Austein's avatar
regen    
Rob Austein committed
8
 - 
Mark Andrews's avatar
Mark Andrews committed
9
10
 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
Rob Austein's avatar
regen    
Rob Austein committed
11
 - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
Mark Andrews's avatar
Mark Andrews committed
12
13
14
15
 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
16
-->
Tinderbox User's avatar
Tinderbox User committed
17
<!-- $Id$ -->
Rob Austein's avatar
regen    
Rob Austein committed
18
19
20
21
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>named-checkzone</title>
Mark Andrews's avatar
regen    
Mark Andrews committed
22
<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
Rob Austein's avatar
regen    
Rob Austein committed
23
24
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
Mark Andrews's avatar
gregen    
Mark Andrews committed
25
<a name="man.named-checkzone"></a><div class="titlepage"></div>
Rob Austein's avatar
regen    
Rob Austein committed
26
27
<div class="refnamediv">
<h2>Name</h2>
28
<p><span class="application">named-checkzone</span>, <span class="application">named-compilezone</span> &#8212; zone file validity checking or converting tool</p>
Rob Austein's avatar
regen    
Rob Austein committed
29
30
31
</div>
<div class="refsynopsisdiv">
<h2>Synopsis</h2>
Tinderbox User's avatar
Tinderbox User committed
32
33
<div class="cmdsynopsis"><p><code class="command">named-checkzone</code>  [<code class="option">-d</code>] [<code class="option">-h</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-J <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-M <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-l <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-S <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div>
<div class="cmdsynopsis"><p><code class="command">named-compilezone</code>  [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-J <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-l <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div>
Rob Austein's avatar
regen    
Rob Austein committed
34
35
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
36
<a name="id2543784"></a><h2>DESCRIPTION</h2>
Rob Austein's avatar
regen    
Rob Austein committed
37
38
39
40
41
42
<p><span><strong class="command">named-checkzone</strong></span>
      checks the syntax and integrity of a zone file.  It performs the
      same checks as <span><strong class="command">named</strong></span> does when loading a
      zone.  This makes <span><strong class="command">named-checkzone</strong></span> useful for
      checking zone files before configuring them into a name server.
    </p>
43
44
45
46
47
48
49
<p>
        <span><strong class="command">named-compilezone</strong></span> is similar to
	<span><strong class="command">named-checkzone</strong></span>, but it always dumps the
        zone contents to a specified file in a specified format.
	Additionally, it applies stricter check levels by default,
        since the dump output will be used as an actual zone file
	loaded by <span><strong class="command">named</strong></span>.
Mark Andrews's avatar
regen    
Mark Andrews committed
50
	When manually specified otherwise, the check levels must at
51
52
53
        least be as strict as those specified in the
	<span><strong class="command">named</strong></span> configuration file.
     </p>
Rob Austein's avatar
regen    
Rob Austein committed
54
55
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
56
<a name="id2543819"></a><h2>OPTIONS</h2>
Rob Austein's avatar
regen    
Rob Austein committed
57
58
59
60
61
<div class="variablelist"><dl>
<dt><span class="term">-d</span></dt>
<dd><p>
            Enable debugging.
          </p></dd>
Mark Andrews's avatar
regen    
Mark Andrews committed
62
63
64
65
<dt><span class="term">-h</span></dt>
<dd><p>
            Print the usage summary and exit.
          </p></dd>
Rob Austein's avatar
regen    
Rob Austein committed
66
67
68
69
70
71
72
73
74
75
76
<dt><span class="term">-q</span></dt>
<dd><p>
            Quiet mode - exit code only.
          </p></dd>
<dt><span class="term">-v</span></dt>
<dd><p>
            Print the version of the <span><strong class="command">named-checkzone</strong></span>
            program and exit.
          </p></dd>
<dt><span class="term">-j</span></dt>
<dd><p>
Tinderbox User's avatar
Tinderbox User committed
77
78
79
80
81
82
83
84
            When loading a zone file, read the journal if it exists.
            The journal file name is assumed to be the zone file name
	    appended with the string <code class="filename">.jnl</code>.
          </p></dd>
<dt><span class="term">-J <em class="replaceable"><code>filename</code></em></span></dt>
<dd><p>
            When loading the zone file read the journal from the given
            file, if it exists. (Implies -j.)
Rob Austein's avatar
regen    
Rob Austein committed
85
86
87
          </p></dd>
<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
<dd><p>
Automatic Updater's avatar
regen    
Automatic Updater committed
88
            Specify the class of the zone.  If not specified, "IN" is assumed.
Rob Austein's avatar
regen    
Rob Austein committed
89
          </p></dd>
Mark Andrews's avatar
regen    
Mark Andrews committed
90
91
92
<dt><span class="term">-i <em class="replaceable"><code>mode</code></em></span></dt>
<dd>
<p>
Mark Andrews's avatar
regen    
Mark Andrews committed
93
	      Perform post-load zone integrity checks.  Possible modes are
Mark Andrews's avatar
regen    
Mark Andrews committed
94
	      <span><strong class="command">"full"</strong></span> (default),
Mark Andrews's avatar
regen    
Mark Andrews committed
95
96
97
	      <span><strong class="command">"full-sibling"</strong></span>,
	      <span><strong class="command">"local"</strong></span>,
	      <span><strong class="command">"local-sibling"</strong></span> and
Mark Andrews's avatar
regen    
Mark Andrews committed
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
	      <span><strong class="command">"none"</strong></span>.
	  </p>
<p>
	      Mode <span><strong class="command">"full"</strong></span> checks that MX records
	      refer to A or AAAA record (both in-zone and out-of-zone
	      hostnames).  Mode <span><strong class="command">"local"</strong></span> only
	      checks MX records which refer to in-zone hostnames.
	  </p>
<p>
	      Mode <span><strong class="command">"full"</strong></span> checks that SRV records
	      refer to A or AAAA record (both in-zone and out-of-zone
	      hostnames).  Mode <span><strong class="command">"local"</strong></span> only
	      checks SRV records which refer to in-zone hostnames.
	  </p>
<p>
	      Mode <span><strong class="command">"full"</strong></span> checks that delegation NS
	      records refer to A or AAAA record (both in-zone and out-of-zone
Mark Andrews's avatar
regen    
Mark Andrews committed
115
	      hostnames).  It also checks that glue address records
Mark Andrews's avatar
regen    
Mark Andrews committed
116
117
118
119
120
	      in the zone match those advertised by the child.
	      Mode <span><strong class="command">"local"</strong></span> only checks NS records which
	      refer to in-zone hostnames or that some required glue exists,
	      that is when the nameserver is in a child zone.
	  </p>
Mark Andrews's avatar
regen    
Mark Andrews committed
121
122
123
124
125
126
<p>
	      Mode <span><strong class="command">"full-sibling"</strong></span> and
	      <span><strong class="command">"local-sibling"</strong></span> disable sibling glue
	      checks but are otherwise the same as <span><strong class="command">"full"</strong></span>
	      and <span><strong class="command">"local"</strong></span> respectively.
	  </p>
Mark Andrews's avatar
regen    
Mark Andrews committed
127
128
129
130
<p>
	      Mode <span><strong class="command">"none"</strong></span> disables the checks.
	  </p>
</dd>
131
132
133
<dt><span class="term">-f <em class="replaceable"><code>format</code></em></span></dt>
<dd><p>
	    Specify the format of the zone file.
Tinderbox User's avatar
Tinderbox User committed
134
	    Possible formats are <span><strong class="command">"text"</strong></span> (default),
Tinderbox User's avatar
Tinderbox User committed
135
	    <span><strong class="command">"raw"</strong></span>, and <span><strong class="command">"map"</strong></span>.
136
137
	  </p></dd>
<dt><span class="term">-F <em class="replaceable"><code>format</code></em></span></dt>
Automatic Updater's avatar
Automatic Updater committed
138
139
<dd>
<p>
140
141
142
143
	    Specify the format of the output file specified.
	    For <span><strong class="command">named-checkzone</strong></span>,
	    this does not cause any effects unless it dumps the zone
	    contents.
Automatic Updater's avatar
Automatic Updater committed
144
145
	  </p>
<p>
Tinderbox User's avatar
Tinderbox User committed
146
147
	    Possible formats are <span><strong class="command">"text"</strong></span> (default),
	    which is the standard textual representation of the zone,
Tinderbox User's avatar
Tinderbox User committed
148
	    and <span><strong class="command">"map"</strong></span>, <span><strong class="command">"raw"</strong></span>,
Tinderbox User's avatar
Tinderbox User committed
149
150
151
152
153
154
            and <span><strong class="command">"raw=N"</strong></span>, which store the zone in a
            binary format for rapid loading by <span><strong class="command">named</strong></span>.
            <span><strong class="command">"raw=N"</strong></span> specifies the format version of
            the raw zone file: if N is 0, the raw file can be read by
            any version of <span><strong class="command">named</strong></span>; if N is 1, the file
            can be read by release 9.9.0 or higher; the default is 1.
Automatic Updater's avatar
Automatic Updater committed
155
156
	  </p>
</dd>
Rob Austein's avatar
regen    
Rob Austein committed
157
158
<dt><span class="term">-k <em class="replaceable"><code>mode</code></em></span></dt>
<dd><p>
Mark Andrews's avatar
regen    
Mark Andrews committed
159
            Perform <span><strong class="command">"check-names"</strong></span> checks with the
160
161
162
163
164
	    specified failure mode.
            Possible modes are <span><strong class="command">"fail"</strong></span>
	    (default for <span><strong class="command">named-compilezone</strong></span>),
            <span><strong class="command">"warn"</strong></span>
	    (default for <span><strong class="command">named-checkzone</strong></span>) and
Rob Austein's avatar
regen    
Rob Austein committed
165
166
            <span><strong class="command">"ignore"</strong></span>.
          </p></dd>
Tinderbox User's avatar
Tinderbox User committed
167
168
169
170
171
172
173
174
<dt><span class="term">-l <em class="replaceable"><code>ttl</code></em></span></dt>
<dd><p>
            Sets a maximum permissible TTL for the input file.
            Any record with a TTL higher than this value will cause
            the zone to be rejected.  This is similar to using the
            <span><strong class="command">max-zone-ttl</strong></span> option in
            <code class="filename">named.conf</code>.
          </p></dd>
Automatic Updater's avatar
Automatic Updater committed
175
176
<dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt>
<dd><p>
Tinderbox User's avatar
Tinderbox User committed
177
            When compiling a zone to "raw" or "map" format, set the
Tinderbox User's avatar
Tinderbox User committed
178
179
180
            "source serial" value in the header to the specified serial
            number.  (This is expected to be used primarily for testing
            purposes.)
Automatic Updater's avatar
Automatic Updater committed
181
          </p></dd>
Mark Andrews's avatar
regen    
Mark Andrews committed
182
183
184
185
186
187
188
<dt><span class="term">-m <em class="replaceable"><code>mode</code></em></span></dt>
<dd><p>
            Specify whether MX records should be checked to see if they
            are addresses.  Possible modes are <span><strong class="command">"fail"</strong></span>,
            <span><strong class="command">"warn"</strong></span> (default) and
            <span><strong class="command">"ignore"</strong></span>.
          </p></dd>
Mark Andrews's avatar
regen    
Mark Andrews committed
189
190
191
192
193
194
195
<dt><span class="term">-M <em class="replaceable"><code>mode</code></em></span></dt>
<dd><p>
	    Check if a MX record refers to a CNAME.
            Possible modes are <span><strong class="command">"fail"</strong></span>,
            <span><strong class="command">"warn"</strong></span> (default) and
            <span><strong class="command">"ignore"</strong></span>.
	  </p></dd>
Rob Austein's avatar
regen    
Rob Austein committed
196
197
198
<dt><span class="term">-n <em class="replaceable"><code>mode</code></em></span></dt>
<dd><p>
            Specify whether NS records should be checked to see if they
199
200
201
202
203
            are addresses.
	    Possible modes are <span><strong class="command">"fail"</strong></span>
	    (default for <span><strong class="command">named-compilezone</strong></span>),
            <span><strong class="command">"warn"</strong></span>
	    (default for <span><strong class="command">named-checkzone</strong></span>) and
Rob Austein's avatar
regen    
Rob Austein committed
204
205
206
207
208
            <span><strong class="command">"ignore"</strong></span>.
          </p></dd>
<dt><span class="term">-o <em class="replaceable"><code>filename</code></em></span></dt>
<dd><p>
            Write zone output to <code class="filename">filename</code>.
Mark Andrews's avatar
regen    
Mark Andrews committed
209
210
	    If <code class="filename">filename</code> is <code class="filename">-</code> then
	    write to standard out.
211
	    This is mandatory for <span><strong class="command">named-compilezone</strong></span>.
Rob Austein's avatar
regen    
Rob Austein committed
212
          </p></dd>
Automatic Updater's avatar
regen    
Automatic Updater committed
213
214
215
216
217
218
219
220
<dt><span class="term">-r <em class="replaceable"><code>mode</code></em></span></dt>
<dd><p>
            Check for records that are treated as different by DNSSEC but
	    are semantically equal in plain DNS.  
            Possible modes are <span><strong class="command">"fail"</strong></span>,
            <span><strong class="command">"warn"</strong></span> (default) and
            <span><strong class="command">"ignore"</strong></span>.
	  </p></dd>
221
222
223
224
<dt><span class="term">-s <em class="replaceable"><code>style</code></em></span></dt>
<dd><p>
	    Specify the style of the dumped zone file.
	    Possible styles are <span><strong class="command">"full"</strong></span> (default)
Mark Andrews's avatar
regen    
Mark Andrews committed
225
	    and <span><strong class="command">"relative"</strong></span>.
226
227
	    The full format is most suitable for processing
	    automatically by a separate script.
Mark Andrews's avatar
regen    
Mark Andrews committed
228
	    On the other hand, the relative format is more
229
230
231
232
233
234
235
	    human-readable and is thus suitable for editing by hand.
	    For <span><strong class="command">named-checkzone</strong></span>
	    this does not cause any effects unless it dumps the zone
	    contents.
	    It also does not have any meaning if the output format
	    is not text.
	  </p></dd>
Mark Andrews's avatar
regen    
Mark Andrews committed
236
237
238
239
240
241
242
<dt><span class="term">-S <em class="replaceable"><code>mode</code></em></span></dt>
<dd><p>
	    Check if a SRV record refers to a CNAME.
            Possible modes are <span><strong class="command">"fail"</strong></span>,
            <span><strong class="command">"warn"</strong></span> (default) and
            <span><strong class="command">"ignore"</strong></span>.
	  </p></dd>
Rob Austein's avatar
regen    
Rob Austein committed
243
244
<dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
<dd><p>
Mark Andrews's avatar
regen    
Mark Andrews committed
245
            Chroot to <code class="filename">directory</code> so that
Rob Austein's avatar
regen    
Rob Austein committed
246
247
248
249
            include
            directives in the configuration file are processed as if
            run by a similarly chrooted named.
          </p></dd>
Tinderbox User's avatar
Tinderbox User committed
250
251
<dt><span class="term">-T <em class="replaceable"><code>mode</code></em></span></dt>
<dd><p>
Tinderbox User's avatar
Tinderbox User committed
252
253
254
255
	    Check if Sender Policy Framework (SPF) records exist
	    and issues a warning if an SPF-formatted TXT record is
	    not also present.  Possible modes are <span><strong class="command">"warn"</strong></span>
	    (default), <span><strong class="command">"ignore"</strong></span>.
Tinderbox User's avatar
Tinderbox User committed
256
	  </p></dd>
Rob Austein's avatar
regen    
Rob Austein committed
257
258
259
260
261
262
263
264
265
266
267
<dt><span class="term">-w <em class="replaceable"><code>directory</code></em></span></dt>
<dd><p>
            chdir to <code class="filename">directory</code> so that
            relative
            filenames in master file $INCLUDE directives work.  This
            is similar to the directory clause in
            <code class="filename">named.conf</code>.
          </p></dd>
<dt><span class="term">-D</span></dt>
<dd><p>
            Dump zone file in canonical format.
268
	    This is always enabled for <span><strong class="command">named-compilezone</strong></span>.
Rob Austein's avatar
regen    
Rob Austein committed
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
          </p></dd>
<dt><span class="term">-W <em class="replaceable"><code>mode</code></em></span></dt>
<dd><p>
            Specify whether to check for non-terminal wildcards.
            Non-terminal wildcards are almost always the result of a
            failure to understand the wildcard matching algorithm (RFC 1034).
            Possible modes are <span><strong class="command">"warn"</strong></span> (default)
            and
            <span><strong class="command">"ignore"</strong></span>.
          </p></dd>
<dt><span class="term">zonename</span></dt>
<dd><p>
            The domain name of the zone being checked.
          </p></dd>
<dt><span class="term">filename</span></dt>
<dd><p>
            The name of the zone file.
          </p></dd>
</dl></div>
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
290
<a name="id2544710"></a><h2>RETURN VALUES</h2>
Rob Austein's avatar
regen    
Rob Austein committed
291
292
293
294
295
296
<p><span><strong class="command">named-checkzone</strong></span>
      returns an exit status of 1 if
      errors were detected and 0 otherwise.
    </p>
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
297
<a name="id2544722"></a><h2>SEE ALSO</h2>
Rob Austein's avatar
regen    
Rob Austein committed
298
<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
Mark Andrews's avatar
regen    
Mark Andrews committed
299
      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
Rob Austein's avatar
regen    
Rob Austein committed
300
301
302
303
304
      <em class="citetitle">RFC 1035</em>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
305
<a name="id2544755"></a><h2>AUTHOR</h2>
Rob Austein's avatar
regen    
Rob Austein committed
306
307
308
309
310
<p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
</div>
</div></body>
</html>