1.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2.. 3.. SPDX-License-Identifier: MPL-2.0 4.. 5.. This Source Code Form is subject to the terms of the Mozilla Public 6.. License, v. 2.0. If a copy of the MPL was not distributed with this 7.. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8.. 9.. See the COPYRIGHT file distributed with this work for additional 10.. information regarding copyright ownership. 11 12.. highlight: console 13 14.. BEWARE: Do not forget to edit also named-compilezone.rst! 15 16.. iscman:: named-checkzone 17.. program:: named-checkzone 18.. _man_named-checkzone: 19 20named-checkzone - zone file validation tool 21------------------------------------------- 22 23Synopsis 24~~~~~~~~ 25 26:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename} 27 28Description 29~~~~~~~~~~~ 30 31:program:`named-checkzone` checks the syntax and integrity of a zone file. It 32performs the same checks as :iscman:`named` does when loading a zone. This 33makes :program:`named-checkzone` useful for checking zone files before 34configuring them into a name server. 35 36Options 37~~~~~~~ 38 39.. option:: -d 40 41 This option enables debugging. 42 43.. option:: -h 44 45 This option prints the usage summary and exits. 46 47.. option:: -q 48 49 This option sets quiet mode, which only sets an exit code to indicate 50 successful or failed completion. 51 52.. option:: -v 53 54 This option prints the version of the :program:`named-checkzone` program and exits. 55 56.. option:: -j 57 58 When loading a zone file, this option tells :iscman:`named` to read the journal if it exists. The journal 59 file name is assumed to be the zone file name with the 60 string ``.jnl`` appended. 61 62.. option:: -J filename 63 64 When loading the zone file, this option tells :iscman:`named` to read the journal from the given file, if 65 it exists. This implies :option:`-j`. 66 67.. option:: -c class 68 69 This option specifies the class of the zone. If not specified, ``IN`` is assumed. 70 71.. option:: -i mode 72 73 This option performs post-load zone integrity checks. Possible modes are 74 ``full`` (the default), ``full-sibling``, ``local``, 75 ``local-sibling``, and ``none``. 76 77 Mode ``full`` checks that MX records refer to A or AAAA records 78 (both in-zone and out-of-zone hostnames). Mode ``local`` only 79 checks MX records which refer to in-zone hostnames. 80 81 Mode ``full`` checks that SRV records refer to A or AAAA records 82 (both in-zone and out-of-zone hostnames). Mode ``local`` only 83 checks SRV records which refer to in-zone hostnames. 84 85 Mode ``full`` checks that delegation NS records refer to A or AAAA 86 records (both in-zone and out-of-zone hostnames). It also checks that 87 glue address records in the zone match those advertised by the child. 88 Mode ``local`` only checks NS records which refer to in-zone 89 hostnames or verifies that some required glue exists, i.e., when the 90 name server is in a child zone. 91 92 Modes ``full-sibling`` and ``local-sibling`` disable sibling glue 93 checks, but are otherwise the same as ``full`` and ``local``, 94 respectively. 95 96 Mode ``none`` disables the checks. 97 98.. option:: -f format 99 100 This option specifies the format of the zone file. Possible formats are 101 ``text`` (the default), and ``raw``. 102 103.. option:: -F format 104 105 This option specifies the format of the output file specified. For 106 :program:`named-checkzone`, this does not have any effect unless it dumps 107 the zone contents. 108 109 Possible formats are ``text`` (the default), which is the standard 110 textual representation of the zone, and ``raw`` and ``raw=N``, which 111 store the zone in a binary format for rapid loading by :iscman:`named`. 112 ``raw=N`` specifies the format version of the raw zone file: if ``N`` is 113 0, the raw file can be read by any version of :iscman:`named`; if N is 1, the 114 file can only be read by release 9.9.0 or higher. The default is 1. 115 116.. option:: -k mode 117 118 This option performs ``check-names`` checks with the specified failure mode. 119 Possible modes are ``fail``, ``warn`` (the default), and ``ignore``. 120 121.. option:: -l ttl 122 123 This option sets a maximum permissible TTL for the input file. Any record with a 124 TTL higher than this value causes the zone to be rejected. This 125 is similar to using the ``max-zone-ttl`` option in :iscman:`named.conf`. 126 127.. option:: -L serial 128 129 When compiling a zone to ``raw`` format, this option sets the "source 130 serial" value in the header to the specified serial number. This is 131 expected to be used primarily for testing purposes. 132 133.. option:: -m mode 134 135 This option specifies whether MX records should be checked to see if they are 136 addresses. Possible modes are ``fail``, ``warn`` (the default), and 137 ``ignore``. 138 139.. option:: -M mode 140 141 This option checks whether a MX record refers to a CNAME. Possible modes are 142 ``fail``, ``warn`` (the default), and ``ignore``. 143 144.. option:: -n mode 145 146 This option specifies whether NS records should be checked to see if they are 147 addresses. Possible modes are ``fail``, ``warn`` (the default), and ``ignore``. 148 149.. option:: -o filename 150 151 This option writes the zone output to ``filename``. If ``filename`` is ``-``, then 152 the zone output is written to standard output. 153 154.. option:: -r mode 155 156 This option checks for records that are treated as different by DNSSEC but are 157 semantically equal in plain DNS. Possible modes are ``fail``, 158 ``warn`` (the default), and ``ignore``. 159 160.. option:: -s style 161 162 This option specifies the style of the dumped zone file. Possible styles are 163 ``full`` (the default) and ``relative``. The ``full`` format is most 164 suitable for processing automatically by a separate script. 165 The relative format is more human-readable and is thus 166 suitable for editing by hand. This does not have any effect unless it dumps 167 the zone contents. It also does not have any meaning if the output format 168 is not text. 169 170.. option:: -S mode 171 172 This option checks whether an SRV record refers to a CNAME. Possible modes are 173 ``fail``, ``warn`` (the default), and ``ignore``. 174 175.. option:: -t directory 176 177 This option tells :iscman:`named` to chroot to ``directory``, so that ``include`` directives in the 178 configuration file are processed as if run by a similarly chrooted 179 :iscman:`named`. 180 181.. option:: -T mode 182 183 This option checks whether Sender Policy Framework (SPF) records exist and issues a 184 warning if an SPF-formatted TXT record is not also present. Possible 185 modes are ``warn`` (the default) and ``ignore``. 186 187.. option:: -w directory 188 189 This option instructs :iscman:`named` to chdir to ``directory``, so that relative filenames in master file 190 ``$INCLUDE`` directives work. This is similar to the directory clause in 191 :iscman:`named.conf`. 192 193.. option:: -D 194 195 This option dumps the zone file in canonical format. 196 197.. option:: -W mode 198 199 This option specifies whether to check for non-terminal wildcards. Non-terminal 200 wildcards are almost always the result of a failure to understand the 201 wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn`` 202 (the default) and ``ignore``. 203 204.. option:: zonename 205 206 This indicates the domain name of the zone being checked. 207 208.. option:: filename 209 210 This is the name of the zone file. 211 212Return Values 213~~~~~~~~~~~~~ 214 215:program:`named-checkzone` returns an exit status of 1 if errors were detected 216and 0 otherwise. 217 218See Also 219~~~~~~~~ 220 221:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-compilezone(8) <named-compilezone>`, :rfc:`1035`, BIND 9 Administrator Reference 222Manual. 223