contrib/bind9/doc/arm/man.rndc.html

   1 <!--
   2  - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
   3  - Copyright (C) 2000-2003 Internet Software Consortium.
   4  -
   5  - Permission to use, copy, modify, and/or distribute this software for any
   6  - purpose with or without fee is hereby granted, provided that the above
   7  - copyright notice and this permission notice appear in all copies.
   8  -
   9  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  10  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  11  - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  12  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  13  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  14  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  15  - PERFORMANCE OF THIS SOFTWARE.
  16 -->
  17 <html>
  18 <head>
  19 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
  20 <title>rndc</title>
  21 <meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
  22 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
  23 <link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
  24 <link rel="prev" href="man.nsupdate.html" title="nsupdate">
  25 <link rel="next" href="man.rndc.conf.html" title="rndc.conf">
  26 </head>
  27 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
  28 <div class="navheader">
  29 <table width="100%" summary="Navigation header">
  30 <tr><th colspan="3" align="center"><span class="application">rndc</span></th></tr>
  31 <tr>
  32 <td width="20%" align="left">
  33 <a accesskey="p" href="man.nsupdate.html">Prev</a> </td>
  34 <th width="60%" align="center">Manual pages</th>
  35 <td width="20%" align="right"> <a accesskey="n" href="man.rndc.conf.html">Next</a>
  36 </td>
  37 </tr>
  38 </table>
  39 <hr>
  40 </div>
  41 <div class="refentry">
  42 <a name="man.rndc"></a><div class="titlepage"></div>
  43 <div class="refnamediv">
  44 <h2>Name</h2>
  45 <p><span class="application">rndc</span> &#8212; name server control utility</p>
  46 </div>
  47 <div class="refsynopsisdiv">
  48 <h2>Synopsis</h2>
  49 <div class="cmdsynopsis"><p><code class="command">rndc</code>  [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
  50 </div>
  51 <div class="refsection">
  52 <a name="id-1.14.21.7"></a><h2>DESCRIPTION</h2>
  53 <p><span class="command"><strong>rndc</strong></span>
  54       controls the operation of a name
  55       server.  It supersedes the <span class="command"><strong>ndc</strong></span> utility
  56       that was provided in old BIND releases.  If
  57       <span class="command"><strong>rndc</strong></span> is invoked with no command line
  58       options or arguments, it prints a short summary of the
  59       supported commands and the available options and their
  60       arguments.
  61     </p>
  62 <p><span class="command"><strong>rndc</strong></span>
  63       communicates with the name server
  64       over a TCP connection, sending commands authenticated with
  65       digital signatures.  In the current versions of
  66       <span class="command"><strong>rndc</strong></span> and <span class="command"><strong>named</strong></span>,
  67       the only supported authentication algorithm is HMAC-MD5,
  68       which uses a shared secret on each end of the connection.
  69       This provides TSIG-style authentication for the command
  70       request and the name server's response.  All commands sent
  71       over the channel must be signed by a key_id known to the
  72       server.
  73     </p>
  74 <p><span class="command"><strong>rndc</strong></span>
  75       reads a configuration file to
  76       determine how to contact the name server and decide what
  77       algorithm and key it should use.
  78     </p>
  79 </div>
  80 <div class="refsection">
  81 <a name="id-1.14.21.8"></a><h2>OPTIONS</h2>
  82 <div class="variablelist"><dl class="variablelist">
  83 <dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
  84 <dd><p>
  85             Use <em class="replaceable"><code>source-address</code></em>
  86             as the source address for the connection to the server.
  87             Multiple instances are permitted to allow setting of both
  88             the IPv4 and IPv6 source addresses.
  89           </p></dd>
  90 <dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
  91 <dd><p>
  92             Use <em class="replaceable"><code>config-file</code></em>
  93             as the configuration file instead of the default,
  94             <code class="filename">/etc/rndc.conf</code>.
  95           </p></dd>
  96 <dt><span class="term">-k <em class="replaceable"><code>key-file</code></em></span></dt>
  97 <dd><p>
  98             Use <em class="replaceable"><code>key-file</code></em>
  99             as the key file instead of the default,
 100             <code class="filename">/etc/rndc.key</code>.  The key in
 101             <code class="filename">/etc/rndc.key</code> will be used to
 102             authenticate
 103             commands sent to the server if the <em class="replaceable"><code>config-file</code></em>
 104             does not exist.
 105           </p></dd>
 106 <dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt>
 107 <dd><p><em class="replaceable"><code>server</code></em> is
 108             the name or address of the server which matches a
 109             server statement in the configuration file for
 110             <span class="command"><strong>rndc</strong></span>.  If no server is supplied on the
 111             command line, the host named by the default-server clause
 112             in the options statement of the <span class="command"><strong>rndc</strong></span>
 113             configuration file will be used.
 114           </p></dd>
 115 <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
 116 <dd><p>
 117             Send commands to TCP port
 118             <em class="replaceable"><code>port</code></em>
 119             instead
 120             of BIND 9's default control channel port, 953.
 121           </p></dd>
 122 <dt><span class="term">-V</span></dt>
 123 <dd><p>
 124             Enable verbose logging.
 125           </p></dd>
 126 <dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt>
 127 <dd><p>
 128             Use the key <em class="replaceable"><code>key_id</code></em>
 129             from the configuration file.
 130             <em class="replaceable"><code>key_id</code></em>
 131             must be
 132             known by <span class="command"><strong>named</strong></span> with the same algorithm and secret string
 133             in order for control message validation to succeed.
 134             If no <em class="replaceable"><code>key_id</code></em>
 135             is specified, <span class="command"><strong>rndc</strong></span> will first look
 136             for a key clause in the server statement of the server
 137             being used, or if no server statement is present for that
 138             host, then the default-key clause of the options statement.
 139             Note that the configuration file contains shared secrets
 140             which are used to send authenticated control commands
 141             to name servers.  It should therefore not have general read
 142             or write access.
 143           </p></dd>
 144 </dl></div>
 145 </div>
 146 <div class="refsection">
 147 <a name="id-1.14.21.9"></a><h2>COMMANDS</h2>
 148 <p>
 149       A list of commands supported by <span class="command"><strong>rndc</strong></span> can
 150       be seen by running <span class="command"><strong>rndc</strong></span> without arguments.
 151     </p>
 152 <p>
 153       Currently supported commands are:
 154     </p>
 155 <div class="variablelist"><dl class="variablelist">
 156 <dt><span class="term"><strong class="userinput"><code>addzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] <em class="replaceable"><code>configuration</code></em> </code></strong></span></dt>
 157 <dd>
 158 <p>
 159             Add a zone while the server is running.  This
 160             command requires the
 161             <span class="command"><strong>allow-new-zones</strong></span> option to be set
 162             to <strong class="userinput"><code>yes</code></strong>.  The
 163             <em class="replaceable"><code>configuration</code></em> string
 164             specified on the command line is the zone
 165             configuration text that would ordinarily be
 166             placed in <code class="filename">named.conf</code>.
 167           </p>
 168 <p>
 169             The configuration is saved in a file called
 170            <code class="filename"><em class="replaceable"><code>hash</code></em>.nzf</code>,
 171             where <em class="replaceable"><code>hash</code></em> is a
 172             cryptographic hash generated from the name of
 173             the view.  When <span class="command"><strong>named</strong></span> is
 174             restarted, the file will be loaded into the view
 175             configuration, so that zones that were added
 176             can persist after a restart.
 177           </p>
 178 <p>
 179             This sample <span class="command"><strong>addzone</strong></span> command
 180             would add the zone <code class="literal">example.com</code>
 181             to the default view:
 182           </p>
 183 <p>
 184 <code class="prompt">$ </code><strong class="userinput"><code>rndc addzone example.com '{ type master; file "example.com.db"; };'</code></strong>
 185           </p>
 186 <p>
 187             (Note the brackets and semi-colon around the zone
 188             configuration text.)
 189           </p>
 190 <p>
 191             See also <span class="command"><strong>rndc delzone</strong></span>.
 192           </p>
 193 </dd>
 194 <dt><span class="term"><strong class="userinput"><code>delzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
 195 <dd>
 196 <p>
 197             Delete a zone while the server is running.
 198             Only zones that were originally added via
 199             <span class="command"><strong>rndc addzone</strong></span> can be deleted
 200             in this manner.
 201           </p>
 202 <p>
 203             See also <span class="command"><strong>rndc addzone</strong></span>
 204           </p>
 205 </dd>
 206 <dt><span class="term"><strong class="userinput"><code>dumpdb [<span class="optional">-all|-cache|-zone|-adb|-bad</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
 207 <dd><p>
 208             Dump the server's caches (default) and/or zones to
 209             the
 210             dump file for the specified views.  If no view is
 211             specified, all
 212             views are dumped.
 213             (See the <span class="command"><strong>dump-file</strong></span> option in
 214             the BIND 9 Administrator Reference Manual.)
 215           </p></dd>
 216 <dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt>
 217 <dd><p>
 218             Flushes the server's cache.
 219           </p></dd>
 220 <dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
 221 <dd><p>
 222             Flushes the given name from the view's DNS cache
 223             and, if applicable, from the view's nameserver address
 224             database or bad-server cache.
 225           </p></dd>
 226 <dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
 227 <dd><p>
 228             Flushes the given name, and all of its subdomains,
 229             from the view's DNS cache.  Note that this does
 230             <span class="emphasis"><em>not</em></span> affect he server's address
 231             database or bad-server cache.
 232           </p></dd>
 233 <dt><span class="term"><strong class="userinput"><code>freeze [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
 234 <dd>
 235 <p>
 236             Suspend updates to a dynamic zone.  If no zone is
 237             specified, then all zones are suspended.  This allows
 238             manual edits to be made to a zone normally updated by
 239             dynamic update.  It also causes changes in the
 240             journal file to be synced into the master file.
 241             All dynamic update attempts will be refused while
 242             the zone is frozen.
 243           </p>
 244 <p>
 245             See also <span class="command"><strong>rndc thaw</strong></span>.
 246           </p>
 247 </dd>
 248 <dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt>
 249 <dd>
 250 <p>
 251             Stop the server immediately.  Recent changes
 252             made through dynamic update or IXFR are not saved to
 253             the master files, but will be rolled forward from the
 254             journal files when the server is restarted.
 255             If <code class="option">-p</code> is specified <span class="command"><strong>named</strong></span>'s process id is returned.
 256             This allows an external process to determine when <span class="command"><strong>named</strong></span>
 257             had completed halting.
 258           </p>
 259 <p>
 260             See also <span class="command"><strong>rndc stop</strong></span>.
 261           </p>
 262 </dd>
 263 <dt><span class="term"><strong class="userinput"><code>loadkeys <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
 264 <dd>
 265 <p>
 266             Fetch all DNSSEC keys for the given zone
 267             from the key directory.  If they are within
 268             their publication period, merge them into the
 269             zone's DNSKEY RRset.  Unlike <span class="command"><strong>rndc
 270             sign</strong></span>, however, the zone is not
 271             immediately re-signed by the new keys, but is
 272             allowed to incrementally re-sign over time.
 273           </p>
 274 <p>
 275             This command requires that the
 276             <span class="command"><strong>auto-dnssec</strong></span> zone option
 277             be set to <code class="literal">maintain</code>,
 278             and also requires the zone to be configured to
 279             allow dynamic DNS.
 280             (See "Dynamic Update Policies" in the Administrator
 281             Reference Manual for more details.)
 282           </p>
 283 </dd>
 284 <dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
 285 <dd><p>
 286             Resend NOTIFY messages for the zone.
 287           </p></dd>
 288 <dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt>
 289 <dd>
 290 <p>
 291             Sets the server's debugging level to 0.
 292           </p>
 293 <p>
 294             See also <span class="command"><strong>rndc trace</strong></span>.
 295           </p>
 296 </dd>
 297 <dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional">on|off</span>] </span></dt>
 298 <dd>
 299 <p>
 300             Enable or disable query logging.  (For backward
 301             compatibility, this command can also be used without
 302             an argument to toggle query logging on and off.)
 303           </p>
 304 <p>
 305             Query logging can also be enabled
 306             by explicitly directing the <span class="command"><strong>queries</strong></span>
 307             <span class="command"><strong>category</strong></span> to a
 308             <span class="command"><strong>channel</strong></span> in the
 309             <span class="command"><strong>logging</strong></span> section of
 310             <code class="filename">named.conf</code> or by specifying
 311             <span class="command"><strong>querylog yes;</strong></span> in the
 312             <span class="command"><strong>options</strong></span> section of
 313             <code class="filename">named.conf</code>.
 314           </p>
 315 </dd>
 316 <dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
 317 <dd><p>
 318             Reload the configuration file and load new zones,
 319             but do not reload existing zone files even if they
 320             have changed.
 321             This is faster than a full <span class="command"><strong>reload</strong></span> when there
 322             is a large number of zones because it avoids the need
 323             to examine the
 324             modification times of the zones files.
 325           </p></dd>
 326 <dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt>
 327 <dd><p>
 328             Dump the list of queries <span class="command"><strong>named</strong></span> is currently
 329             recursing on, and the list of domains to which iterative
 330             queries are currently being sent.  (The second list includes
 331             the number of fetches currently active for the given domain,
 332             and how many have been passed or dropped because of the
 333             <code class="option">fetches-per-zone</code> option.)
 334           </p></dd>
 335 <dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
 336 <dd><p>
 337             Schedule zone maintenance for the given zone.
 338           </p></dd>
 339 <dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
 340 <dd><p>
 341             Reload configuration file and zones.
 342           </p></dd>
 343 <dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
 344 <dd><p>
 345             Reload the given zone.
 346           </p></dd>
 347 <dt><span class="term"><strong class="userinput"><code>retransfer <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
 348 <dd>
 349 <p>
 350             Retransfer the given slave zone from the master server.
 351           </p>
 352 <p>
 353             If the zone is configured to use
 354             <span class="command"><strong>inline-signing</strong></span>, the signed
 355             version of the zone is discarded; after the
 356             retransfer of the unsigned version is complete, the
 357             signed version will be regenerated with all new
 358             signatures.
 359           </p>
 360 </dd>
 361 <dt><span class="term"><strong class="userinput"><code>secroots [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
 362 <dd><p>
 363             Dump the server's security roots to the secroots
 364             file for the specified views.  If no view is
 365             specified, security roots for all
 366             views are dumped.
 367           </p></dd>
 368 <dt><span class="term"><strong class="userinput"><code>sign <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
 369 <dd>
 370 <p>
 371             Fetch all DNSSEC keys for the given zone
 372             from the key directory (see the
 373             <span class="command"><strong>key-directory</strong></span> option in
 374             the BIND 9 Administrator Reference Manual).  If they are within
 375             their publication period, merge them into the
 376             zone's DNSKEY RRset.  If the DNSKEY RRset
 377             is changed, then the zone is automatically
 378             re-signed with the new key set.
 379           </p>
 380 <p>
 381             This command requires that the
 382             <span class="command"><strong>auto-dnssec</strong></span> zone option be set
 383             to <code class="literal">allow</code> or
 384             <code class="literal">maintain</code>,
 385             and also requires the zone to be configured to
 386             allow dynamic DNS.
 387             (See "Dynamic Update Policies" in the Administrator
 388             Reference Manual for more details.)
 389           </p>
 390 <p>
 391             See also <span class="command"><strong>rndc loadkeys</strong></span>.
 392           </p>
 393 </dd>
 394 <dt><span class="term"><strong class="userinput"><code>signing [<span class="optional">( -list | -clear <em class="replaceable"><code>keyid/algorithm</code></em> | -clear <code class="literal">all</code> | -nsec3param ( <em class="replaceable"><code>parameters</code></em> | <code class="literal">none</code> ) ) </span>] <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
 395 <dd>
 396 <p>
 397             List, edit, or remove the DNSSEC signing state records
 398             for the specified zone.  The status of ongoing DNSSEC
 399             operations (such as signing or generating
 400             NSEC3 chains) is stored in the zone in the form
 401             of DNS resource records of type
 402             <span class="command"><strong>sig-signing-type</strong></span>.
 403             <span class="command"><strong>rndc signing -list</strong></span> converts
 404             these records into a human-readable form,
 405             indicating which keys are currently signing
 406             or have finished signing the zone, and which NSEC3
 407             chains are being created or removed.
 408           </p>
 409 <p>
 410             <span class="command"><strong>rndc signing -clear</strong></span> can remove
 411             a single key (specified in the same format that
 412             <span class="command"><strong>rndc signing -list</strong></span> uses to
 413             display it), or all keys.  In either case, only
 414             completed keys are removed; any record indicating
 415             that a key has not yet finished signing the zone
 416             will be retained.
 417           </p>
 418 <p>
 419             <span class="command"><strong>rndc signing -nsec3param</strong></span> sets
 420             the NSEC3 parameters for a zone.  This is the
 421             only supported mechanism for using NSEC3 with
 422             <span class="command"><strong>inline-signing</strong></span> zones.
 423             Parameters are specified in the same format as
 424             an NSEC3PARAM resource record: hash algorithm,
 425             flags, iterations, and salt, in that order.
 426           </p>
 427 <p>
 428             Currently, the only defined value for hash algorithm
 429             is <code class="literal">1</code>, representing SHA-1.
 430             The <code class="option">flags</code> may be set to
 431             <code class="literal">0</code> or <code class="literal">1</code>,
 432             depending on whether you wish to set the opt-out
 433             bit in the NSEC3 chain.  <code class="option">iterations</code>
 434             defines the number of additional times to apply
 435             the algorithm when generating an NSEC3 hash.  The
 436             <code class="option">salt</code> is a string of data expressed
 437             in hexadecimal, or a hyphen (`-') if no salt is
 438             to be used.
 439           </p>
 440 <p>
 441             So, for example, to create an NSEC3 chain using
 442             the SHA-1 hash algorithm, no opt-out flag,
 443             10 iterations, and a salt value of "FFFF", use:
 444             <span class="command"><strong>rndc signing -nsec3param 1 0 10 FFFF <em class="replaceable"><code>zone</code></em></strong></span>.
 445             To set the opt-out flag, 15 iterations, and no
 446             salt, use:
 447             <span class="command"><strong>rndc signing -nsec3param 1 1 15 - <em class="replaceable"><code>zone</code></em></strong></span>.
 448           </p>
 449 <p>
 450             <span class="command"><strong>rndc signing -nsec3param none</strong></span>
 451             removes an existing NSEC3 chain and replaces it
 452             with NSEC.
 453           </p>
 454 </dd>
 455 <dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt>
 456 <dd><p>
 457             Write server statistics to the statistics file.
 458             (See the <span class="command"><strong>statistics-file</strong></span> option in
 459             the BIND 9 Administrator Reference Manual.)
 460           </p></dd>
 461 <dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
 462 <dd><p>
 463             Display status of the server.
 464             Note that the number of zones includes the internal <span class="command"><strong>bind/CH</strong></span> zone
 465             and the default <span class="command"><strong>./IN</strong></span>
 466             hint zone if there is not an
 467             explicit root zone configured.
 468           </p></dd>
 469 <dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt>
 470 <dd>
 471 <p>
 472             Stop the server, making sure any recent changes
 473             made through dynamic update or IXFR are first saved to
 474             the master files of the updated zones.
 475             If <code class="option">-p</code> is specified <span class="command"><strong>named</strong></span>'s process id is returned.
 476             This allows an external process to determine when <span class="command"><strong>named</strong></span>
 477             had completed stopping.
 478           </p>
 479 <p>See also <span class="command"><strong>rndc halt</strong></span>.</p>
 480 </dd>
 481 <dt><span class="term"><strong class="userinput"><code>sync [<span class="optional">-clean</span>] [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
 482 <dd><p>
 483             Sync changes in the journal file for a dynamic zone
 484             to the master file.  If the "-clean" option is
 485             specified, the journal file is also removed.  If
 486             no zone is specified, then all zones are synced.
 487           </p></dd>
 488 <dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
 489 <dd>
 490 <p>
 491             Enable updates to a frozen dynamic zone.  If no
 492             zone is specified, then all frozen zones are
 493             enabled.  This causes the server to reload the zone
 494             from disk, and re-enables dynamic updates after the
 495             load has completed.  After a zone is thawed,
 496             dynamic updates will no longer be refused.  If
 497             the zone has changed and the
 498             <span class="command"><strong>ixfr-from-differences</strong></span> option is
 499             in use, then the journal file will be updated to
 500             reflect changes in the zone.  Otherwise, if the
 501             zone has changed, any existing journal file will be
 502             removed.
 503           </p>
 504 <p>See also <span class="command"><strong>rndc freeze</strong></span>.</p>
 505 </dd>
 506 <dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
 507 <dd><p>
 508             Increment the servers debugging level by one.
 509           </p></dd>
 510 <dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
 511 <dd>
 512 <p>
 513             Sets the server's debugging level to an explicit
 514             value.
 515           </p>
 516 <p>
 517             See also <span class="command"><strong>rndc notrace</strong></span>.
 518           </p>
 519 </dd>
 520 <dt><span class="term"><strong class="userinput"><code>tsig-delete</code></strong> <em class="replaceable"><code>keyname</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span></dt>
 521 <dd><p>
 522             Delete a given TKEY-negotiated key from the server.
 523             (This does not apply to statically configured TSIG
 524             keys.)
 525           </p></dd>
 526 <dt><span class="term"><strong class="userinput"><code>tsig-list</code></strong></span></dt>
 527 <dd><p>
 528             List the names of all TSIG keys currently configured
 529             for use by <span class="command"><strong>named</strong></span> in each view.  The
 530             list both statically configured keys and dynamic
 531             TKEY-negotiated keys.
 532           </p></dd>
 533 <dt><span class="term"><strong class="userinput"><code>validation ( on | off | check ) [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>] </code></strong></span></dt>
 534 <dd><p>
 535             Enable, disable, or check the current status of
 536             DNSSEC validation.
 537             Note <span class="command"><strong>dnssec-enable</strong></span> also needs to be
 538             set to <strong class="userinput"><code>yes</code></strong> or
 539             <strong class="userinput"><code>auto</code></strong> to be effective.
 540             It defaults to enabled.
 541           </p></dd>
 542 </dl></div>
 543 </div>
 544 <div class="refsection">
 545 <a name="id-1.14.21.10"></a><h2>LIMITATIONS</h2>
 546 <p>
 547       There is currently no way to provide the shared secret for a
 548       <code class="option">key_id</code> without using the configuration file.
 549     </p>
 550 <p>
 551       Several error messages could be clearer.
 552     </p>
 553 </div>
 554 <div class="refsection">
 555 <a name="id-1.14.21.11"></a><h2>SEE ALSO</h2>
 556 <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
 557       <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
 558       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
 559       <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
 560       <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
 561       <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
 562     </p>
 563 </div>
 564 </div>
 565 <div class="navfooter">
 566 <hr>
 567 <table width="100%" summary="Navigation footer">
 568 <tr>
 569 <td width="40%" align="left">
 570 <a accesskey="p" href="man.nsupdate.html">Prev</a> </td>
 571 <td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
 572 <td width="40%" align="right"> <a accesskey="n" href="man.rndc.conf.html">Next</a>
 573 </td>
 574 </tr>
 575 <tr>
 576 <td width="40%" align="left" valign="top">
 577 <span class="application">nsupdate</span> </td>
 578 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
 579 <td width="40%" align="right" valign="top"> <code class="filename">rndc.conf</code>
 580 </td>
 581 </tr>
 582 </table>
 583 </div>
 584 <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.9.9-P4 (Extended Support Version)</p>
 585 </body>
 586 </html>