man.rndc.html 34.9 KB
Newer Older
Mark Andrews's avatar
gregen    
Mark Andrews committed
1
<!--
Tinderbox User's avatar
Tinderbox User committed
2
 - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
Mark Andrews's avatar
gregen    
Mark Andrews committed
3
4
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
Automatic Updater's avatar
regen    
Automatic Updater committed
5
 - Permission to use, copy, modify, and/or distribute this software for any
Mark Andrews's avatar
gregen    
Mark Andrews committed
6
7
8
9
10
11
12
13
14
15
16
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 - 
 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
-->
Tinderbox User's avatar
Tinderbox User committed
17
<!-- $Id$ -->
Mark Andrews's avatar
gregen    
Mark Andrews committed
18
19
20
21
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>rndc</title>
Mark Andrews's avatar
regen    
Mark Andrews committed
22
<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
Mark Andrews's avatar
gregen    
Mark Andrews committed
23
24
<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
Automatic Updater's avatar
regen    
Automatic Updater committed
25
<link rel="prev" href="man.nsupdate.html" title="nsupdate">
Mark Andrews's avatar
gregen    
Mark Andrews committed
26
27
28
29
30
31
32
33
<link rel="next" href="man.rndc.conf.html" title="rndc.conf">
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
<div class="navheader">
<table width="100%" summary="Navigation header">
<tr><th colspan="3" align="center"><span class="application">rndc</span></th></tr>
<tr>
<td width="20%" align="left">
Automatic Updater's avatar
regen    
Automatic Updater committed
34
<a accesskey="p" href="man.nsupdate.html">Prev</a> </td>
Mark Andrews's avatar
gregen    
Mark Andrews committed
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
<th width="60%" align="center">Manual pages</th>
<td width="20%" align="right"> <a accesskey="n" href="man.rndc.conf.html">Next</a>
</td>
</tr>
</table>
<hr>
</div>
<div class="refentry" lang="en">
<a name="man.rndc"></a><div class="titlepage"></div>
<div class="refnamediv">
<h2>Name</h2>
<p><span class="application">rndc</span> &#8212; name server control utility</p>
</div>
<div class="refsynopsisdiv">
<h2>Synopsis</h2>
Tinderbox User's avatar
Tinderbox User committed
50
<div class="cmdsynopsis"><p><code class="command">rndc</code>  [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-q</code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
Mark Andrews's avatar
gregen    
Mark Andrews committed
51
52
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
53
<a name="id2655604"></a><h2>DESCRIPTION</h2>
Mark Andrews's avatar
gregen    
Mark Andrews committed
54
55
56
57
58
59
60
61
62
63
<p><span><strong class="command">rndc</strong></span>
      controls the operation of a name
      server.  It supersedes the <span><strong class="command">ndc</strong></span> utility
      that was provided in old BIND releases.  If
      <span><strong class="command">rndc</strong></span> is invoked with no command line
      options or arguments, it prints a short summary of the
      supported commands and the available options and their
      arguments.
    </p>
<p><span><strong class="command">rndc</strong></span>
Tinderbox User's avatar
Tinderbox User committed
64
65
66
      communicates with the name server over a TCP connection, sending
      commands authenticated with digital signatures.  In the current
      versions of
Mark Andrews's avatar
regen    
Mark Andrews committed
67
      <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>,
Tinderbox User's avatar
Tinderbox User committed
68
69
70
71
      the only supported authentication algorithms are HMAC-MD5
      (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256
      (default), HMAC-SHA384 and HMAC-SHA512.
      They use a shared secret on each end of the connection.
Mark Andrews's avatar
gregen    
Mark Andrews committed
72
73
74
75
76
77
78
79
80
81
82
83
      This provides TSIG-style authentication for the command
      request and the name server's response.  All commands sent
      over the channel must be signed by a key_id known to the
      server.
    </p>
<p><span><strong class="command">rndc</strong></span>
      reads a configuration file to
      determine how to contact the name server and decide what
      algorithm and key it should use.
    </p>
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
84
<a name="id2655654"></a><h2>OPTIONS</h2>
Mark Andrews's avatar
gregen    
Mark Andrews committed
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
<div class="variablelist"><dl>
<dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
<dd><p>
            Use <em class="replaceable"><code>source-address</code></em>
            as the source address for the connection to the server.
            Multiple instances are permitted to allow setting of both
            the IPv4 and IPv6 source addresses.
          </p></dd>
<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
<dd><p>
            Use <em class="replaceable"><code>config-file</code></em>
            as the configuration file instead of the default,
            <code class="filename">/etc/rndc.conf</code>.
          </p></dd>
<dt><span class="term">-k <em class="replaceable"><code>key-file</code></em></span></dt>
<dd><p>
            Use <em class="replaceable"><code>key-file</code></em>
            as the key file instead of the default,
            <code class="filename">/etc/rndc.key</code>.  The key in
            <code class="filename">/etc/rndc.key</code> will be used to
            authenticate
            commands sent to the server if the <em class="replaceable"><code>config-file</code></em>
            does not exist.
          </p></dd>
<dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt>
<dd><p><em class="replaceable"><code>server</code></em> is
Mark Andrews's avatar
regen    
Mark Andrews committed
111
            the name or address of the server which matches a
Mark Andrews's avatar
gregen    
Mark Andrews committed
112
            server statement in the configuration file for
Mark Andrews's avatar
regen    
Mark Andrews committed
113
            <span><strong class="command">rndc</strong></span>.  If no server is supplied on the
Mark Andrews's avatar
gregen    
Mark Andrews committed
114
            command line, the host named by the default-server clause
Mark Andrews's avatar
regen    
Mark Andrews committed
115
            in the options statement of the <span><strong class="command">rndc</strong></span>
Tinderbox User's avatar
Tinderbox User committed
116
            configuration file will be used.
Mark Andrews's avatar
gregen    
Mark Andrews committed
117
118
119
120
121
122
123
124
          </p></dd>
<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
<dd><p>
            Send commands to TCP port
            <em class="replaceable"><code>port</code></em>
            instead
            of BIND 9's default control channel port, 953.
          </p></dd>
Tinderbox User's avatar
Tinderbox User committed
125
126
127
128
129
<dt><span class="term">-q</span></dt>
<dd><p>
            Quiet mode: Message text returned by the server
            will not be printed except when there is an error.
          </p></dd>
Mark Andrews's avatar
gregen    
Mark Andrews committed
130
131
132
133
<dt><span class="term">-V</span></dt>
<dd><p>
            Enable verbose logging.
          </p></dd>
Mark Andrews's avatar
regen    
Mark Andrews committed
134
<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt>
Mark Andrews's avatar
gregen    
Mark Andrews committed
135
<dd><p>
Mark Andrews's avatar
regen    
Mark Andrews committed
136
            Use the key <em class="replaceable"><code>key_id</code></em>
Mark Andrews's avatar
gregen    
Mark Andrews committed
137
            from the configuration file.
Mark Andrews's avatar
regen    
Mark Andrews committed
138
            <em class="replaceable"><code>key_id</code></em>
Mark Andrews's avatar
gregen    
Mark Andrews committed
139
140
141
            must be
            known by named with the same algorithm and secret string
            in order for control message validation to succeed.
Mark Andrews's avatar
regen    
Mark Andrews committed
142
            If no <em class="replaceable"><code>key_id</code></em>
Mark Andrews's avatar
gregen    
Mark Andrews committed
143
144
145
146
147
148
149
150
151
152
            is specified, <span><strong class="command">rndc</strong></span> will first look
            for a key clause in the server statement of the server
            being used, or if no server statement is present for that
            host, then the default-key clause of the options statement.
            Note that the configuration file contains shared secrets
            which are used to send authenticated control commands
            to name servers.  It should therefore not have general read
            or write access.
          </p></dd>
</dl></div>
Tinderbox User's avatar
Tinderbox User committed
153
154
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
155
<a name="id2661610"></a><h2>COMMANDS</h2>
Mark Andrews's avatar
gregen    
Mark Andrews committed
156
<p>
Tinderbox User's avatar
Tinderbox User committed
157
158
      A list of commands supported by <span><strong class="command">rndc</strong></span> can
      be seen by running <span><strong class="command">rndc</strong></span> without arguments.
Mark Andrews's avatar
gregen    
Mark Andrews committed
159
    </p>
Tinderbox User's avatar
Tinderbox User committed
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
<p>
      Currently supported commands are:
    </p>
<div class="variablelist"><dl>
<dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
<dd><p>
            Reload configuration file and zones.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
<dd><p>
            Reload the given zone.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
<dd><p>
            Schedule zone maintenance for the given zone.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>retransfer <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
Tinderbox User's avatar
Tinderbox User committed
177
178
179
180
181
182
183
184
185
186
187
188
189
<dd>
<p>
            Retransfer the given slave zone from the master server.
          </p>
<p>
            If the zone is configured to use
            <span><strong class="command">inline-signing</strong></span>, the signed
            version of the zone is discarded; after the
            retransfer of the unsigned version is complete, the
            signed version will be regenerated with all new
            signatures.
          </p>
</dd>
Tinderbox User's avatar
Tinderbox User committed
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
<dt><span class="term"><strong class="userinput"><code>sign <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
<dd>
<p>
            Fetch all DNSSEC keys for the given zone
            from the key directory (see the 
            <span><strong class="command">key-directory</strong></span> option in
            the BIND 9 Administrator Reference Manual).  If they are within
            their publication period, merge them into the
            zone's DNSKEY RRset.  If the DNSKEY RRset
            is changed, then the zone is automatically
            re-signed with the new key set.
          </p>
<p>
            This command requires that the
            <span><strong class="command">auto-dnssec</strong></span> zone option be set
            to <code class="literal">allow</code> or
            <code class="literal">maintain</code>,
            and also requires the zone to be configured to
            allow dynamic DNS.
            (See "Dynamic Update Policies" in the Administrator
            Reference Manual for more details.)
          </p>
</dd>
<dt><span class="term"><strong class="userinput"><code>loadkeys <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
<dd>
<p>
            Fetch all DNSSEC keys for the given zone
            from the key directory.  If they are within
            their publication period, merge them into the
            zone's DNSKEY RRset.  Unlike <span><strong class="command">rndc
            sign</strong></span>, however, the zone is not
            immediately re-signed by the new keys, but is
            allowed to incrementally re-sign over time.
          </p>
<p>
            This command requires that the
            <span><strong class="command">auto-dnssec</strong></span> zone option
            be set to <code class="literal">maintain</code>,
            and also requires the zone to be configured to
            allow dynamic DNS.
            (See "Dynamic Update Policies" in the Administrator
            Reference Manual for more details.)
          </p>
</dd>
<dt><span class="term"><strong class="userinput"><code>freeze [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
<dd><p>
            Suspend updates to a dynamic zone.  If no zone is
            specified, then all zones are suspended.  This allows
            manual edits to be made to a zone normally updated by
            dynamic update.  It also causes changes in the
            journal file to be synced into the master file.
            All dynamic update attempts will be refused while
            the zone is frozen.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
<dd><p>
            Enable updates to a frozen dynamic zone.  If no
            zone is specified, then all frozen zones are
            enabled.  This causes the server to reload the zone
            from disk, and re-enables dynamic updates after the
            load has completed.  After a zone is thawed,
            dynamic updates will no longer be refused.  If
            the zone has changed and the
            <span><strong class="command">ixfr-from-differences</strong></span> option is
            in use, then the journal file will be updated to
            reflect changes in the zone.  Otherwise, if the
            zone has changed, any existing journal file will be
            removed.
          </p></dd>
Tinderbox User's avatar
Tinderbox User committed
259
260
261
262
263
264
265
<dt><span class="term"><strong class="userinput"><code>scan</code></strong></span></dt>
<dd><p>
             Scan the list of available network interfaces
             for changes, without performing a full
             <span><strong class="command">reconfig</strong></span> or waiting for the
             <span><strong class="command">interface-interval</strong></span> timer.
          </p></dd>
Tinderbox User's avatar
Tinderbox User committed
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
<dt><span class="term"><strong class="userinput"><code>sync [<span class="optional">-clean</span>] [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
<dd><p>
            Sync changes in the journal file for a dynamic zone
            to the master file.  If the "-clean" option is
            specified, the journal file is also removed.  If
            no zone is specified, then all zones are synced.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
<dd><p>
            Resend NOTIFY messages for the zone.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
<dd><p>
            Reload the configuration file and load new zones,
            but do not reload existing zone files even if they
            have changed.
            This is faster than a full <span><strong class="command">reload</strong></span> when there
            is a large number of zones because it avoids the need
            to examine the
            modification times of the zones files.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>zonestatus [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
<dd><p>
            Displays the current status of the given zone,
            including the master file name and any include
            files from which it was loaded, when it was most
            recently loaded, the current serial number, the
            number of nodes, whether the zone supports
            dynamic updates, whether the zone is DNSSEC
            signed, whether it uses automatic DNSSEC key
            management or inline signing, and the scheduled
            refresh or expiry times for the zone.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt>
<dd><p>
            Write server statistics to the statistics file.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional">on|off</span>] </span></dt>
<dd>
<p>
            Enable or disable query logging.  (For backward
            compatibility, this command can also be used without
            an argument to toggle query logging on and off.)
          </p>
<p>
            Query logging can also be enabled
            by explicitly directing the <span><strong class="command">queries</strong></span>
            <span><strong class="command">category</strong></span> to a
            <span><strong class="command">channel</strong></span> in the
            <span><strong class="command">logging</strong></span> section of
            <code class="filename">named.conf</code> or by specifying
            <span><strong class="command">querylog yes;</strong></span> in the
            <span><strong class="command">options</strong></span> section of
            <code class="filename">named.conf</code>.
          </p>
</dd>
<dt><span class="term"><strong class="userinput"><code>dumpdb [<span class="optional">-all|-cache|-zone</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
<dd><p>
            Dump the server's caches (default) and/or zones to
            the
            dump file for the specified views.  If no view is
            specified, all
            views are dumped.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
<dd><p>
Tinderbox User's avatar
Tinderbox User committed
332
333
334
            Dump the server's security roots and negative trust anchors
            to the secroots file for the specified views.  If no view is
            specified, all views are dumped.
Tinderbox User's avatar
Tinderbox User committed
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt>
<dd><p>
            Stop the server, making sure any recent changes
            made through dynamic update or IXFR are first saved to
            the master files of the updated zones.
            If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
            This allows an external process to determine when <span><strong class="command">named</strong></span>
            had completed stopping.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt>
<dd><p>
            Stop the server immediately.  Recent changes
            made through dynamic update or IXFR are not saved to
            the master files, but will be rolled forward from the
            journal files when the server is restarted.
            If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
            This allows an external process to determine when <span><strong class="command">named</strong></span>
            had completed halting.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
<dd><p>
            Increment the servers debugging level by one.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
<dd><p>
            Sets the server's debugging level to an explicit
            value.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt>
<dd><p>
            Sets the server's debugging level to 0.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt>
<dd><p>
            Flushes the server's cache.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
<dd><p>
Tinderbox User's avatar
Tinderbox User committed
374
375
376
            Flushes the given name from the view's DNS cache
            and, if applicable, from the view's nameserver address
            database, bad server cache and SERVFAIL cache.
Tinderbox User's avatar
Tinderbox User committed
377
          </p></dd>
Tinderbox User's avatar
Tinderbox User committed
378
<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
Tinderbox User's avatar
Tinderbox User committed
379
380
<dd><p>
            Flushes the given name, and all of its subdomains,
Tinderbox User's avatar
Tinderbox User committed
381
382
            from the view's DNS cache, address database,
            bad server cache, and SERVFAIL cache.
Tinderbox User's avatar
Tinderbox User committed
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
<dd><p>
            Display status of the server.
            Note that the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone
            and the default <span><strong class="command">./IN</strong></span>
            hint zone if there is not an
            explicit root zone configured.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt>
<dd><p>
            Dump the list of queries <span><strong class="command">named</strong></span> is currently recursing
            on.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>validation ( on | off | check ) [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>] </code></strong></span></dt>
<dd><p>
            Enable, disable, or check the current status of
            DNSSEC validation.
            Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
            set to <strong class="userinput"><code>yes</code></strong> or
            <strong class="userinput"><code>auto</code></strong> to be effective.
            It defaults to enabled.
          </p></dd>
Tinderbox User's avatar
Tinderbox User committed
406
407
408
409
410
<dt><span class="term"><strong class="userinput"><code>nta
	[<span class="optional">( -d | -f | -r | -l <em class="replaceable"><code>duration</code></em>)</span>]
	<em class="replaceable"><code>domain</code></em>
	[<span class="optional"><em class="replaceable"><code>view</code></em></span>]
	</code></strong></span></dt>
Tinderbox User's avatar
Tinderbox User committed
411
412
413
414
<dd>
<p>
            Sets a DNSSEC negative trust anchor (NTA)
            for <code class="option">domain</code>, with a lifetime of
Tinderbox User's avatar
Tinderbox User committed
415
416
417
            <code class="option">lifetime</code>.  The default lifetime is
            configured in <font color="red">&lt;file&gt;named.conf&lt;/file&gt;</font> via the
            <code class="option">nta-lifetime</code>, and defaults to
Tinderbox User's avatar
Tinderbox User committed
418
            one hour.  The lifetime cannot exceed one week.
Tinderbox User's avatar
Tinderbox User committed
419
420
421
422
423
424
425
426
427
428
429
430
431
432
          </p>
<p>
            A negative trust anchor selectively disables
            DNSSEC validation for zones that known to be
            failing because of misconfiguration rather than
            an attack.  When data to be validated is
            at or below an active NTA (and above any other
            configured trust anchors), <span><strong class="command">named</strong></span> will
            abort the DNSSEC validation process and treat the data as
            insecure rather than bogus.  This continues until the
            NTA's lifetime is elapsed, or until the server is
            restarted (NTA's do not persist across restarts).
          </p>
<p>
Tinderbox User's avatar
Tinderbox User committed
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
            An existing NTA can be removed by using the
            <code class="option">-remove</code> option.
          </p>
<p>
            An NTA's lifetime can be specified with the
            <code class="option">-lifetime</code> option.  TTL-style
            suffixes can be used to specify the lifetime in
            seconds, minutes, or hours.  If the specified NTA
            already exists, its lifetime will be updated to the
            new value.  Setting <code class="option">lifetime</code> to zero
            is equivalent to <code class="option">-remove</code>.
          </p>
<p>
            If <code class="option">-dump</code> is used, any other arguments
            are ignored, and a list of existing NTAs is printed
            (note that this may include NTAs that are expired but
            have not yet been cleaned up).
          </p>
<p>
            Normally, <span><strong class="command">named</strong></span> will periodically
            test to see whether data below an NTA can now be
            validated (see the <code class="option">nta-recheck</code> option
            in the Administrator Reference Manual for details).
            If data can be validated, then the NTA is regarded as
            no longer necessary, and will be allowed to expire
            early.  The <code class="option">-force</code> overrides this
            behavior and forces an NTA to persist for its entire
            lifetime, regardless of whether data could be
            validated if the NTA were not present.
Tinderbox User's avatar
Tinderbox User committed
462
463
          </p>
<p>
Tinderbox User's avatar
Tinderbox User committed
464
465
466
            All of these options can be shortened, i.e., to
            <code class="option">-l</code>, <code class="option">-r</code>, <code class="option">-d</code>,
            and <code class="option">-f</code>.
Tinderbox User's avatar
Tinderbox User committed
467
468
          </p>
</dd>
Tinderbox User's avatar
Tinderbox User committed
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
<dt><span class="term"><strong class="userinput"><code>tsig-list</code></strong></span></dt>
<dd><p>
            List the names of all TSIG keys currently configured
            for use by <span><strong class="command">named</strong></span> in each view.  The
            list both statically configured keys and dynamic
            TKEY-negotiated keys.
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>tsig-delete</code></strong> <em class="replaceable"><code>keyname</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span></dt>
<dd><p>
            Delete a given TKEY-negotiated key from the server.
            (This does not apply to statically configured TSIG
            keys.)
          </p></dd>
<dt><span class="term"><strong class="userinput"><code>addzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] <em class="replaceable"><code>configuration</code></em> </code></strong></span></dt>
<dd>
<p>
            Add a zone while the server is running.  This
            command requires the
            <span><strong class="command">allow-new-zones</strong></span> option to be set
            to <strong class="userinput"><code>yes</code></strong>.  The
            <em class="replaceable"><code>configuration</code></em> string
            specified on the command line is the zone
            configuration text that would ordinarily be
            placed in <code class="filename">named.conf</code>.
          </p>
<p>
            The configuration is saved in a file called
           <code class="filename"><em class="replaceable"><code>hash</code></em>.nzf</code>,
            where <em class="replaceable"><code>hash</code></em> is a
            cryptographic hash generated from the name of
            the view.  When <span><strong class="command">named</strong></span> is
            restarted, the file will be loaded into the view
            configuration, so that zones that were added
            can persist after a restart.
          </p>
<p>
            This sample <span><strong class="command">addzone</strong></span> command
            would add the zone <code class="literal">example.com</code>
            to the default view:
          </p>
<p>
<code class="prompt">$ </code><strong class="userinput"><code>rndc addzone example.com '{ type master; file "example.com.db"; };'</code></strong>
          </p>
<p>
            (Note the brackets and semi-colon around the zone
            configuration text.)
          </p>
</dd>
<dt><span class="term"><strong class="userinput"><code>delzone [<span class="optional">-clean</span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
<dd>
<p>
            Delete a zone while the server is running.
            Only zones that were originally added via
            <span><strong class="command">rndc addzone</strong></span> can be deleted
            in this manner. 
          </p>
<p>
            If the <code class="option">-clean</code> is specified,
            the zone's master file (and journal file, if any)
            will be deleted along with the zone.  Without the
            <code class="option">-clean</code> option, zone files must
            be cleaned up by hand.  (If the zone is of
            type "slave" or "stub", the files needing to
            be cleaned up will be reported in the output
            of the <span><strong class="command">rndc delzone</strong></span> command.)
          </p>
</dd>
<dt><span class="term"><strong class="userinput"><code>signing [<span class="optional">( -list | -clear <em class="replaceable"><code>keyid/algorithm</code></em> | -clear <code class="literal">all</code> | -nsec3param ( <em class="replaceable"><code>parameters</code></em> | <code class="literal">none</code> ) ) </span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
<dd>
<p>
Tinderbox User's avatar
Tinderbox User committed
539
540
            List, edit, or remove the DNSSEC signing state records
            for the specified zone.  The status of ongoing DNSSEC
Tinderbox User's avatar
Tinderbox User committed
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
            operations (such as signing or generating
            NSEC3 chains) is stored in the zone in the form
            of DNS resource records of type
            <span><strong class="command">sig-signing-type</strong></span>. 
            <span><strong class="command">rndc signing -list</strong></span> converts
            these records into a human-readable form,
            indicating which keys are currently signing
            or have finished signing the zone, and which NSEC3
            chains are being created or removed.
          </p>
<p>
            <span><strong class="command">rndc signing -clear</strong></span> can remove
            a single key (specified in the same format that
            <span><strong class="command">rndc signing -list</strong></span> uses to
            display it), or all keys.  In either case, only
            completed keys are removed; any record indicating
            that a key has not yet finished signing the zone
            will be retained.
          </p>
<p>
            <span><strong class="command">rndc signing -nsec3param</strong></span> sets
            the NSEC3 parameters for a zone.  This is the
            only supported mechanism for using NSEC3 with
            <span><strong class="command">inline-signing</strong></span> zones.
            Parameters are specified in the same format as
            an NSEC3PARAM resource record: hash algorithm,
            flags, iterations, and salt, in that order.
          </p>
<p>
            Currently, the only defined value for hash algorithm 
            is <code class="literal">1</code>, representing SHA-1.
            The <code class="option">flags</code> may be set to
            <code class="literal">0</code> or <code class="literal">1</code>,
            depending on whether you wish to set the opt-out
            bit in the NSEC3 chain.  <code class="option">iterations</code>
            defines the number of additional times to apply
            the algorithm when generating an NSEC3 hash.  The
            <code class="option">salt</code> is a string of data expressed
Tinderbox User's avatar
Tinderbox User committed
579
580
581
582
            in hexadecimal, a hyphen (`-') if no salt is
            to be used, or the keyword <code class="literal">auto</code>,
            which causes <span><strong class="command">named</strong></span> to generate a
            random 64-bit salt.
Tinderbox User's avatar
Tinderbox User committed
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
          </p>
<p>
            So, for example, to create an NSEC3 chain using
            the SHA-1 hash algorithm, no opt-out flag,
            10 iterations, and a salt value of "FFFF", use:
            <span><strong class="command">rndc signing -nsec3param 1 0 10 FFFF <em class="replaceable"><code>zone</code></em></strong></span>.
            To set the opt-out flag, 15 iterations, and no
            salt, use:
            <span><strong class="command">rndc signing -nsec3param 1 1 15 - <em class="replaceable"><code>zone</code></em></strong></span>.
          </p>
<p>
            <span><strong class="command">rndc signing -nsec3param none</strong></span>
            removes an existing NSEC3 chain and replaces it
            with NSEC.
          </p>
</dd>
</dl></div>
Mark Andrews's avatar
gregen    
Mark Andrews committed
600
601
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
602
<a name="id2687894"></a><h2>LIMITATIONS</h2>
Mark Andrews's avatar
gregen    
Mark Andrews committed
603
604
605
606
607
608
609
610
611
<p>
      There is currently no way to provide the shared secret for a
      <code class="option">key_id</code> without using the configuration file.
    </p>
<p>
      Several error messages could be clearer.
    </p>
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
612
<a name="id2687912"></a><h2>SEE ALSO</h2>
Mark Andrews's avatar
gregen    
Mark Andrews committed
613
<p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
Mark Andrews's avatar
regen    
Mark Andrews committed
614
      <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
Mark Andrews's avatar
gregen    
Mark Andrews committed
615
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
Mark Andrews's avatar
regen    
Mark Andrews committed
616
      <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
Mark Andrews's avatar
gregen    
Mark Andrews committed
617
618
619
620
621
      <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
622
<a name="id2687968"></a><h2>AUTHOR</h2>
Mark Andrews's avatar
gregen    
Mark Andrews committed
623
624
625
626
627
628
629
630
631
<p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
</div>
</div>
<div class="navfooter">
<hr>
<table width="100%" summary="Navigation footer">
<tr>
<td width="40%" align="left">
Automatic Updater's avatar
regen    
Automatic Updater committed
632
<a accesskey="p" href="man.nsupdate.html">Prev</a> </td>
Mark Andrews's avatar
gregen    
Mark Andrews committed
633
634
635
636
637
<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
<td width="40%" align="right"> <a accesskey="n" href="man.rndc.conf.html">Next</a>
</td>
</tr>
<tr>
Mark Andrews's avatar
regen    
Mark Andrews committed
638
<td width="40%" align="left" valign="top">
Automatic Updater's avatar
regen    
Automatic Updater committed
639
<span class="application">nsupdate</span> </td>
Mark Andrews's avatar
gregen    
Mark Andrews committed
640
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
Mark Andrews's avatar
regen    
Mark Andrews committed
641
642
<td width="40%" align="right" valign="top"> <code class="filename">rndc.conf</code>
</td>
Mark Andrews's avatar
gregen    
Mark Andrews committed
643
644
645
</tr>
</table>
</div>
Tinderbox User's avatar
Tinderbox User committed
646
<p style="text-align: center;">BIND Version 9.11</p>
Mark Andrews's avatar
gregen    
Mark Andrews committed
647
648
</body>
</html>