validns(1)

NAME

validns - DNS and DSNSEC zone file validator

VERSION

This document describes validns version 0.10.0

SYNOPSIS

validns -h validns [options] zone-file

For validating stdin, specify "-" in place of zone-file.

DESCRIPTION

Coming soon.

ZONE FILE FORMAT
Format of zone files follows that of RFC 1035 section 5.1. with a one exception. "\.", aka dots in labels, are not supported due to how domain names are stored internally. Additionally, $TTL is supported as described in RFC 2308 and $GENERATE is partly supported.

OPTIONS

-h  Produce usage text and quit.

-f  Quit on first validation error. Normally, validns continues working on a zone after encountering a parsing or validation error.

-p name
    Activate policy check name. By default, only basic checks and DNSSEC checks are performed. This option can be specified multiple times. See POLICY CHECKS, below, for details.

-n N
    Use N worker threads for parallelizable operations. The default is 0, meaning no parallelization. Currently only signature verification is parallelizable.

-q  quiet - do not produce any output

-s  Print validation summary/stats. If specified twice, also print record counts by type.

-v  be extra verbose

-M  use SOA MINTTL as the default TTL when no TTL specified

-I path
    use this path for $INCLUDE files

-z origin
    use this origin as initial $ORIGIN

-t epoch-time
    Use specified time instead of the current time when verifying validity of the signatures. This option may be specified multiple times, in which case every signature is checked against all specified times.

-V  Print version and exit.

BASIC CHECKS

Every record and every supported directive should be parsable, which consitutes the most basic check of all. The validns program will report the exact reason why it cannot parse a record or a directive.

Other basic checks include:

•   there could only be one SOA in a zone;

•   the first record in the zone must be an SOA record;

•   a record outside the apex;

•   TTL values differ within an RR set (excepting RRSIG);

DNSSEC CHECKS

•   type exists, but NSEC does not mention it for name;

•   NSEC mentions type, but no such record found for name;

•   NSEC says x is the last name, but z exists;

•   NSEC says z comes after x, but nothing does;

•   NSEC says z comes after x, but y does;

•   signature is too new;

•   signature is too old;

•   RRSIG exists for non-existing type type;

•   RRSIG's original TTL differs from corresponding record's;

•   RRSIG(type): cannot find a signer key;

•   RRSIG(type): cannot verify the signature;

•   RRSIG(type): cannot find the right signer key;

•   NSEC3 record name is not valid;

•   multiple NSEC3 with the same record name;

•   no corresponding NSEC3 found for name;

•   type exists, but NSEC3 does not mention it for name;

•   NSEC3 mentions type, but no such record found for name;

•   there are more record types than NSEC3 mentions for name;

•   broken NSEC3 chain, expected name, but nothing found;

•   broken NSEC3 chain, expected name1, but found name2;

•   NSEC3 without a corresponding record (or empty non-terminal);

•   algorithm signatures cannot be validated: digest is disabled by system crypto policy.

On systems where cryptographic algorithms are restricted by policy (e.g., RHEL 9/CentOS 9 with SHA-1 disabled), validns detects this and reports which algorithms cannot be validated. Affected signatures are skipped rather than producing cryptic errors.

POLICY CHECKS

The following policy checks are understood:

single-ns
    Checks that there are at least two NS records per name (or zero).

cname-other-data
    Checks for CNAME and other data condition (excluding possible and NSEC).

dname
    DNAME checks: no multiple DNAMEs, no descendants of a node with a DNAME. Please note that DNAME/CNAME clash is handled by CNAME and other data check already.

dnskey
    DNSKEY checks: public key too short, leading zero octets in public key exponent or modulus.

nsec3param-not-apex
    NSEC3PARAM, if present, should only be at the zone apex.

mx-alias
    MX exchange should not be an alias.

ns-alias
    NS nsdname should not be an alias.

rp-txt-exists
    TXT domain name mentioned in RP record must have a corresponding TXT record if it is within the zone.

tlsa-host
    Domain name of a TLSA record must be a proper prefixed DNS name.

ksk-exists
    A KSK key must exist in a signed zone.

smimea-host
    Domain name must have the form which is proper for an SMIMEA record.

all Activates all of the above policy checks (but not the ones described below).

permit-starting-hyphen
    Starting hyphen (normally disallowed) is permitted in names.

BUGS

•   textual segments in TXT and HINFO must be enclosed in double quotes;

If at least one NSEC3 record uses opt-out flag, validns assumes it is used as much as possible, that is, every unsigned delegation does not have a corresponding NSEC3 record. This is done for reasons of efficiency, to avoid calculating cryptographic hashes of every unsigned delegation. If this assumption is wrong for a zone, validns will produce spurious validation errors.

ACKNOWLEDGEMENTS

Thanks go to Andy Holdaway, Daniel Stirnimann, Dennis Kjaer Jensen, Goran Bengtson, Hirohisa Yamaguchi, Hugo Salgado, Jake Zack, Jakob Schlyter, Koh-ichi Ito, Mathieu Arnold, Miek Gieben, Patrik Wallstrom, Paul Wouters, Ryan Eby, Tony Finch, Willem Toorop, and YAMAGUCHI Takanori for bug reports, testing, discussions, and occasional patches.

Special thanks to Stephane Bortzmeyer and Phil Regnauld.

Thanks for AFNIC which funded major portion of the development. Thanks for SWITCH for additional funding.