ldns-walk(1) [centos man page]

ldns-walk(1)						      General Commands Manual						      ldns-walk(1)

NAME

       ldns-walk - Retrieve the contents of a DNSSEC signed zone

SYNOPSIS

       ldns-walk [ OPTION ] ZONE

DESCRIPTION

       ldns-walk  is  used  to	retrieve  the  contents  of  a DNSSEC signed zone.  It does this through NSEC-walking (following the chain of NSEC
       records) and 'guessing' the next non-existent owner name for each NSEC.

       Note that it might get stuck on some wildcard records when used through a caching forwarder. This problem can be circumvented  by  querying
       the authoritative nameserver directly (with the @ argument).

       Of course the nameserver that is used must be DNSSEC-aware.

OPTIONS

       -4     Use only IPv4.

       -6     Use only IPv6.

       -f     Do  a  'full'  zone walk; by default, ldns-walk will only show the names, and types present at those names. If this option is given,
	      all resource records will be printed.

       -s name
	      Start the walk with this owner name. Useful when continuing the walk for a large zone.

       -v verbosity
	      Verbosity level [1-5].

       @ nameserver
	      Send the queries to this nameserver.

BUGS

       The full zone walk function is not complete yet, it does not correctly print delegation records

AUTHOR

       Written by Jelte Jansen as an example for ldns usage.

REPORTING BUGS

       Report bugs to <ldns-team@nlnetlabs.nl>.

COPYRIGHT

       Copyright (C) 2005 NLnet Labs. This is free software. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A  PARTICULAR  PUR-
       POSE.

								    21 Nov 2005 						      ldns-walk(1)

ldns-verifyzone(1)					      General Commands Manual						ldns-verifyzone(1)

NAME

       ldns-verify-zone - read a DNSSEC signed zone and verify it.

SYNOPSIS

       ldns-verify-zone ZONEFILE

DESCRIPTION

       ldns-verify-zone reads a DNS zone file and verifies it.

       RRSIG resource records are checked against the DNSKEY set at the zone apex.

       Each name is checked for an NSEC(3), if appropriate.

OPTIONS

       -h     Show usage and exit

       -a     Apex only, check only the zone apex

       -e period
	      Signatures may not expire within this period.  Default no period is used.

       -i period
	      Signatures must have been valid at least this long.  Default signatures should just be valid now.

       -k file
	      A file that contains a trusted DNSKEY or DS rr.  This option may be given more than once.

       -p [0-100]
	      Only check this percentage of the zone.  Which names to check is determined randomly.  Defaults to 100.

       -S     Chase signature(s) to a known key.  The network may be accessed to validate the zone's DNSKEYs. (implies -k)

       -t YYYYMMDDhhmmss | [+|-]offset
	      Set the validation time either by an absolute time value or as an offset in seconds from the current time.

       -v     Show the version and exit

       -V number
	      Set the verbosity level (default 3):

	       0: Be silent
	       1: Print result, and any errors
	       2: Same as 1 for now
	       3: Print result, any errors, and the names that are
		  being checked
	       4: Same as 3 for now
	       5: Print the zone after it has been read, the result,
		  any errors, and the names that are being checked

       periods are given in ISO 8601 duration format:
	      P[n]Y[n]M[n]DT[n]H[n]M[n]S

       If no file is given standard input is read.

AUTHOR

       Written by the ldns team as an example for ldns usage.

REPORTING BUGS

       Report bugs to <ldns-team@nlnetlabs.nl>.

COPYRIGHT

       Copyright  (C)  2008 NLnet Labs. This is free software. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PUR-
       POSE.

								    27 May 2008 						ldns-verifyzone(1)