1.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2.. 3.. SPDX-License-Identifier: MPL-2.0 4.. 5.. This Source Code Form is subject to the terms of the Mozilla Public 6.. License, v. 2.0. If a copy of the MPL was not distributed with this 7.. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8.. 9.. See the COPYRIGHT file distributed with this work for additional 10.. information regarding copyright ownership. 11 12.. highlight: console 13 14.. _man_delv: 15 16delv - DNS lookup and validation utility 17---------------------------------------- 18 19Synopsis 20~~~~~~~~ 21 22:program:`delv` [@server] [ [**-4**] | [**-6**] ] [**-a** anchor-file] [**-b** address] [**-c** class] [**-d** level] [**-i**] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-x** addr] [name] [type] [class] [queryopt...] 23 24:program:`delv` [**-h**] 25 26:program:`delv` [**-v**] 27 28:program:`delv` [queryopt...] [query...] 29 30Description 31~~~~~~~~~~~ 32 33``delv`` is a tool for sending DNS queries and validating the results, 34using the same internal resolver and validator logic as ``named``. 35 36``delv`` sends to a specified name server all queries needed to 37fetch and validate the requested data; this includes the original 38requested query, subsequent queries to follow CNAME or DNAME chains, 39queries for DNSKEY, and DS records to establish a chain of trust for 40DNSSEC validation. It does not perform iterative resolution, but 41simulates the behavior of a name server configured for DNSSEC validating 42and forwarding. 43 44By default, responses are validated using the built-in DNSSEC trust anchor 45for the root zone ("."). Records returned by ``delv`` are either fully 46validated or were not signed. If validation fails, an explanation of the 47failure is included in the output; the validation process can be traced 48in detail. Because ``delv`` does not rely on an external server to carry 49out validation, it can be used to check the validity of DNS responses in 50environments where local name servers may not be trustworthy. 51 52Unless it is told to query a specific name server, ``delv`` tries 53each of the servers listed in ``/etc/resolv.conf``. If no usable server 54addresses are found, ``delv`` sends queries to the localhost 55addresses (127.0.0.1 for IPv4, ::1 for IPv6). 56 57When no command-line arguments or options are given, ``delv`` 58performs an NS query for "." (the root zone). 59 60Simple Usage 61~~~~~~~~~~~~ 62 63A typical invocation of ``delv`` looks like: 64 65:: 66 67 delv @server name type 68 69where: 70 71``server`` 72 is the name or IP address of the name server to query. This can be an 73 IPv4 address in dotted-decimal notation or an IPv6 address in 74 colon-delimited notation. When the supplied ``server`` argument is a 75 hostname, ``delv`` resolves that name before querying that name 76 server (note, however, that this initial lookup is *not* validated by 77 DNSSEC). 78 79 If no ``server`` argument is provided, ``delv`` consults 80 ``/etc/resolv.conf``; if an address is found there, it queries the 81 name server at that address. If either of the ``-4`` or ``-6`` 82 options is in use, then only addresses for the corresponding 83 transport are tried. If no usable addresses are found, ``delv`` 84 sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1 85 for IPv6). 86 87``name`` 88 is the domain name to be looked up. 89 90``type`` 91 indicates what type of query is required - ANY, A, MX, etc. 92 ``type`` can be any valid query type. If no ``type`` argument is 93 supplied, ``delv`` performs a lookup for an A record. 94 95Options 96~~~~~~~ 97 98``-a anchor-file`` 99 This option specifies a file from which to read DNSSEC trust anchors. The default 100 is ``/etc/bind.keys``, which is included with BIND 9 and contains one 101 or more trust anchors for the root zone ("."). 102 103 Keys that do not match the root zone name are ignored. An alternate 104 key name can be specified using the ``+root=NAME`` options. 105 106 Note: When reading the trust anchor file, ``delv`` treats ``trust-anchors``, 107 ``initial-key``, and ``static-key`` identically. That is, for a managed key, 108 it is the *initial* key that is trusted; :rfc:`5011` key management is not 109 supported. ``delv`` does not consult the managed-keys database maintained by 110 ``named``, which means that if either of the keys in ``/etc/bind.keys`` is 111 revoked and rolled over, ``/etc/bind.keys`` must be updated to 112 use DNSSEC validation in ``delv``. 113 114``-b address`` 115 This option sets the source IP address of the query to ``address``. This must be 116 a valid address on one of the host's network interfaces, or ``0.0.0.0``, 117 or ``::``. An optional source port may be specified by appending 118 ``#<port>`` 119 120``-c class`` 121 This option sets the query class for the requested data. Currently, only class 122 "IN" is supported in ``delv`` and any other value is ignored. 123 124``-d level`` 125 This option sets the systemwide debug level to ``level``. The allowed range is 126 from 0 to 99. The default is 0 (no debugging). Debugging traces from 127 ``delv`` become more verbose as the debug level increases. See the 128 ``+mtrace``, ``+rtrace``, and ``+vtrace`` options below for 129 additional debugging details. 130 131``-h`` 132 This option displays the ``delv`` help usage output and exits. 133 134``-i`` 135 This option sets insecure mode, which disables internal DNSSEC validation. (Note, 136 however, that this does not set the CD bit on upstream queries. If the 137 server being queried is performing DNSSEC validation, then it does 138 not return invalid data; this can cause ``delv`` to time out. When it 139 is necessary to examine invalid data to debug a DNSSEC problem, use 140 ``dig +cd``.) 141 142``-m`` 143 This option enables memory usage debugging. 144 145``-p port#`` 146 This option specifies a destination port to use for queries, instead of the 147 standard DNS port number 53. This option is used with a name 148 server that has been configured to listen for queries on a 149 non-standard port number. 150 151``-q name`` 152 This option sets the query name to ``name``. While the query name can be 153 specified without using the ``-q`` option, it is sometimes necessary to 154 disambiguate names from types or classes (for example, when looking 155 up the name "ns", which could be misinterpreted as the type NS, or 156 "ch", which could be misinterpreted as class CH). 157 158``-t type`` 159 This option sets the query type to ``type``, which can be any valid query type 160 supported in BIND 9 except for zone transfer types AXFR and IXFR. As 161 with ``-q``, this is useful to distinguish query-name types or classes 162 when they are ambiguous. It is sometimes necessary to disambiguate 163 names from types. 164 165 The default query type is "A", unless the ``-x`` option is supplied 166 to indicate a reverse lookup, in which case it is "PTR". 167 168``-v`` 169 This option prints the ``delv`` version and exits. 170 171``-x addr`` 172 This option performs a reverse lookup, mapping an address to a name. ``addr`` 173 is an IPv4 address in dotted-decimal notation, or a colon-delimited 174 IPv6 address. When ``-x`` is used, there is no need to provide the 175 ``name`` or ``type`` arguments; ``delv`` automatically performs a 176 lookup for a name like ``11.12.13.10.in-addr.arpa`` and sets the 177 query type to PTR. IPv6 addresses are looked up using nibble format 178 under the IP6.ARPA domain. 179 180``-4`` 181 This option forces ``delv`` to only use IPv4. 182 183``-6`` 184 This option forces ``delv`` to only use IPv6. 185 186Query Options 187~~~~~~~~~~~~~ 188 189``delv`` provides a number of query options which affect the way results 190are displayed, and in some cases the way lookups are performed. 191 192Each query option is identified by a keyword preceded by a plus sign 193(``+``). Some keywords set or reset an option. These may be preceded by 194the string ``no`` to negate the meaning of that keyword. Other keywords 195assign values to options like the timeout interval. They have the form 196``+keyword=value``. The query options are: 197 198``+[no]cdflag`` 199 This option controls whether to set the CD (checking disabled) bit in queries 200 sent by ``delv``. This may be useful when troubleshooting DNSSEC 201 problems from behind a validating resolver. A validating resolver 202 blocks invalid responses, making it difficult to retrieve them 203 for analysis. Setting the CD flag on queries causes the resolver 204 to return invalid responses, which ``delv`` can then validate 205 internally and report the errors in detail. 206 207``+[no]class`` 208 This option controls whether to display the CLASS when printing a record. The 209 default is to display the CLASS. 210 211``+[no]ttl`` 212 This option controls whether to display the TTL when printing a record. The 213 default is to display the TTL. 214 215``+[no]rtrace`` 216 This option toggles resolver fetch logging. This reports the name and type of each 217 query sent by ``delv`` in the process of carrying out the resolution 218 and validation process, including the original query 219 and all subsequent queries to follow CNAMEs and to establish a chain 220 of trust for DNSSEC validation. 221 222 This is equivalent to setting the debug level to 1 in the "resolver" 223 logging category. Setting the systemwide debug level to 1 using the 224 ``-d`` option produces the same output, but affects other 225 logging categories as well. 226 227``+[no]mtrace`` 228 This option toggles message logging. This produces a detailed dump of the 229 responses received by ``delv`` in the process of carrying out the 230 resolution and validation process. 231 232 This is equivalent to setting the debug level to 10 for the "packets" 233 module of the "resolver" logging category. Setting the systemwide 234 debug level to 10 using the ``-d`` option produces the same 235 output, but affects other logging categories as well. 236 237``+[no]vtrace`` 238 This option toggles validation logging. This shows the internal process of the 239 validator as it determines whether an answer is validly signed, 240 unsigned, or invalid. 241 242 This is equivalent to setting the debug level to 3 for the 243 "validator" module of the "dnssec" logging category. Setting the 244 systemwide debug level to 3 using the ``-d`` option produces the 245 same output, but affects other logging categories as well. 246 247``+[no]short`` 248 This option toggles between verbose and terse answers. The default is to print the answer in a 249 verbose form. 250 251``+[no]comments`` 252 This option toggles the display of comment lines in the output. The default is to 253 print comments. 254 255``+[no]rrcomments`` 256 This option toggles the display of per-record comments in the output (for example, 257 human-readable key information about DNSKEY records). The default is 258 to print per-record comments. 259 260``+[no]crypto`` 261 This option toggles the display of cryptographic fields in DNSSEC records. The 262 contents of these fields are unnecessary to debug most DNSSEC 263 validation failures and removing them makes it easier to see the 264 common failures. The default is to display the fields. When omitted, 265 they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the 266 key ID is displayed as the replacement, e.g. ``[ key id = value ]``. 267 268``+[no]trust`` 269 This option controls whether to display the trust level when printing a record. 270 The default is to display the trust level. 271 272``+[no]split[=W]`` 273 This option splits long hex- or base64-formatted fields in resource records into 274 chunks of ``W`` characters (where ``W`` is rounded up to the nearest 275 multiple of 4). ``+nosplit`` or ``+split=0`` causes fields not to be 276 split at all. The default is 56 characters, or 44 characters when 277 multiline mode is active. 278 279``+[no]all`` 280 This option sets or clears the display options ``+[no]comments``, 281 ``+[no]rrcomments``, and ``+[no]trust`` as a group. 282 283``+[no]multiline`` 284 This option prints long records (such as RRSIG, DNSKEY, and SOA records) in a 285 verbose multi-line format with human-readable comments. The default 286 is to print each record on a single line, to facilitate machine 287 parsing of the ``delv`` output. 288 289``+[no]dnssec`` 290 This option indicates whether to display RRSIG records in the ``delv`` output. 291 The default is to do so. Note that (unlike in ``dig``) this does 292 *not* control whether to request DNSSEC records or to 293 validate them. DNSSEC records are always requested, and validation 294 always occurs unless suppressed by the use of ``-i`` or 295 ``+noroot``. 296 297``+[no]root[=ROOT]`` 298 This option indicates whether to perform conventional DNSSEC validation, and if so, 299 specifies the name of a trust anchor. The default is to validate using a 300 trust anchor of "." (the root zone), for which there is a built-in key. If 301 specifying a different trust anchor, then ``-a`` must be used to specify a 302 file containing the key. 303 304``+[no]tcp`` 305 This option controls whether to use TCP when sending queries. The default is to 306 use UDP unless a truncated response has been received. 307 308``+[no]unknownformat`` 309 This option prints all RDATA in unknown RR-type presentation format (:rfc:`3597`). 310 The default is to print RDATA for known types in the type's 311 presentation format. 312 313``+[no]yaml`` 314 This option prints response data in YAML format. 315 316Files 317~~~~~ 318 319``/etc/bind.keys`` 320 321``/etc/resolv.conf`` 322 323See Also 324~~~~~~~~ 325 326:manpage:`dig(1)`, :manpage:`named(8)`, :rfc:`4034`, :rfc:`4035`, :rfc:`4431`, :rfc:`5074`, :rfc:`5155`. 327