delv
(1)DNS lookup and validation utility
Options
14-aThis option specifies a file from which to read an alternate DNSSEC root zone trust anchor. By default, keys that do not match the root zone name (.) are ignored. If an alternate key name is desired, it can be specified using the +root option. Note: When reading trust anchors, delv treats trust-anchors, initial-key, and static-key identically. That is, for a managed key, it is the initial key that is trusted; RFC 5011 <https://datatracker.ietf.org/doc/html/rfc5011.html> key management is not supported. delv does not consult the managed-keys database maintained by named <#std-iscman-named>. Thi
-bThis option sets the source IP address of the query to address. This must be a valid address on one of the host's network interfaces, or 0.0.0.0, or ::. An optional source port may be specified by appending #<port>
-cThis option sets the query class for the requested data. Currently, only class "IN" is supported in delv and any other value is ignored.
-dThis option sets the systemwide debug level to level. The allowed range is from 0 to 99. The default is 0 (no debugging). Debugging traces from delv become more verbose as the debug level increases. See the +mtrace, +rtrace, and +vtrace options below for additional debugging details.
-hThis option displays the delv help usage output and exits.
-iThis option sets insecure mode, which disables internal DNSSEC validation. (Note, however, that this does not set the CD bit on upstream queries. If the server being queried is performing DNSSEC validation, then it does not return invalid data; this can cause delv to time out. When it is necessary to examine invalid data to debug a DNSSEC problem, use dig +cd <#cmdoption-dig-arg-cd>.)
-mThis option enables memory usage debugging.
-pThis option specifies a destination port to use for queries, instead of the standard DNS port number 53. This option is used with a name server that has been configured to listen for queries on a non-standard port number.
-qThis option sets the query name to name. While the query name can be specified without using the -q option, it is sometimes necessary to disambiguate names from types or classes (for example, when looking up the name "ns", which could be misinterpreted as the type NS, or "ch", which could be misinterpreted as class CH).
-tThis option sets the query type to type, which can be any valid query type supported in BIND 9 except for zone transfer types AXFR and IXFR. As with -q, this is useful to distinguish query-name types or classes when they are ambiguous. It is sometimes necessary to disambiguate names from types. The default query type is "A", unless the -x option is supplied to indicate a reverse lookup, in which case it is "PTR".
-vThis option prints the delv version and exits.
-xThis option performs a reverse lookup, mapping an address to a name. addr is an IPv4 address in dotted-decimal notation, or a colon-delimited IPv6 address. When -x is used, there is no need to provide the name or type arguments; delv automatically performs a lookup for a name like 11.12.13.10.in-addr.arpa and sets the query type to PTR. IPv6 addresses are looked up using nibble format under the IP6.ARPA domain.
-4This option forces delv to only use IPv4.
-6This option forces delv to only use IPv6.
DESCRIPTION
delv is a tool for sending DNS queries and validating the results, using the same internal resolver and validator logic as named <#std-iscman-named>.
delv sends to a specified name server all queries needed to fetch and validate the requested data; this includes the original requested query, subsequent queries to follow CNAME or DNAME chains, queries for DNSKEY, and DS records to establish a chain of trust for DNSSEC validation. It does not perform iterative resolution, but simulates the behavior of a name server configured for DNSSEC validating and forwarding.
By default, responses are validated using the built-in DNSSEC trust anchor for the root zone ("."). Records returned by delv are either fully validated or were not signed. If validation fails, an explanation of the failure is included in the output; the validation process can be traced in detail. Because delv does not rely on an external server to carry out validation, it can be used to check the validity of DNS responses in environments where local name servers may not be trustworthy.
Unless it is told to query a specific name server, delv tries each of the servers listed in /etc/resolv.conf. If no usable server addresses are found, delv sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1 for IPv6).
When no command-line arguments or options are given, delv performs an NS query for "." (the root zone).
SIMPLE USAGE
A typical invocation of delv looks like:
delv @server name type
where:
- server
- is the name or IP address of the name server to query. This can be an IPv4
address in dotted-decimal notation or an IPv6 address in colon-delimited
notation. When the supplied server argument is a hostname,
delv resolves that name before querying that name server (note,
however, that this initial lookup is not validated by DNSSEC).
If no server argument is provided, delv consults /etc/resolv.conf; if an address is found there, it queries the name server at that address. If either of the -4 or -6 options is in use, then only addresses for the corresponding transport are tried. If no usable addresses are found, delv sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1 for IPv6).
- name
- is the domain name to be looked up.
- type
- indicates what type of query is required - ANY, A, MX, etc. type can be any valid query type. If no type argument is supplied, delv performs a lookup for an A record.