dnsviz-probe(1) | General Commands Manual | dnsviz-probe(1) |
dnsviz-probe - issue diagnostic DNS queries
dnsviz probe [ options ] [ domain_name... ]
Perform a series of diagnostic queries of specified names to either recursive (default) or authoritative DNS servers, the results of which are serialized into JSON format. Its output is used to assess the health of DNS deployments, using, e.g., dnsviz-grok(1) and dnsviz-graph(1).
Domain names to be processed may be passed either as command-line arguments or in a file (using the -f option). When the -r option is used, then the domain names can simply be implied using the diagnostic query input.
Domain names are extracted from the diagnostic query input in conjunction with -r only when -f is not used and no domain names are supplied on the command line. If the -f option is used, then names may not be specified on the command line.
The domain names passed as input are fully-qualified domain names, such as example.com, www.example.com, _443._tcp.example.com, 1.2.0.192.in-addr.arpa, or 8.b.d.0.1.0.0.2.ip6.arpa. Because it is implied that specified domain names are fully qualified, no trailing dot is necessary.
If this option is used, then names may not be specified on the command line.
This option can be used more than once to supply both an IPv4 and an IPv6 address.
The use of this option is sometimes necessary when using a dual-homed machine, and it is desirable to use the non-default interface for queries.
Issue DNS queries from www.example.com using the cgi script dnsviz-lg.cgi:
http://www.example.com/cgi-bin/dnsviz-lg.cgi
Same, but use HTTP Basic authentication:
http://username:password@www.example.com/cgi-bin/dnsviz-lg.cgi
Issue DNS queries from host.example.com on which DNSViz is also installed.
ssh://username@host.example.com
Note that a looking glass that uses https is only supported when using python version 2.7.9 or greater.
Each server specified may either be an address (IPv4 or IPv6), a domain name (which will be resolved to an address using the standard resolution process), or both, using the syntax name=address. Note that when both a name and an address are specified (name=address), the name is only used for identification purposes, and it doesn't matter whether the name resolves to the corresponding address (or at all, for that matter). IPv6 addresses must be wrapped in square brackets, e.g., "[2001:db8::1]".
Each server value may optionally be suffixed with a numeric port on which the server should be contacted. If not specified, the standard DNS port, 53, is used.
The following are example server values:
ns1.example.com
ns1.example.com:5333
ns1.example.com=192.0.2.1
ns1.example.com=[2001:db8::1]
ns1.example.com=[2001:db8::1]:5333
192.0.2.1
This option cannot be used in conjunction with -A.
The default behavior is to identify and query servers authoritative for ancestors of the specified domain, if other options so dictate. However, if the domain ends in "+", then queries aren't issued for servers authoritative for ancestor domains of the domain. For example, with the following command:
the com servers will be queried for DS records for example.com. However, if the following is used:
no queries are performed at com servers or above, including DS records for example.com.
See -s for the syntax used for designating servers. However, unlike the -s option, a zone file may be specified in lieu of a server name and/or address, in which case an instance of named(8) is started, the zone is served from that instance, and queries for the domain are directed to the local instance of named(8) serving that zone. For example, if example.com.zone is a file containing the contents of the example.com zone, the following command could be used to specify that the zone file should be used:
This option may be used multiple times on the command line.
This option can only be used in conjunction with -A.
This option has similar usage to that of the -x option. The major difference is that the server names supplied comprise the NS record set, and the addresses supplied represent glue records. Thus if there are discrepancies between the authoritative responses for the NS RRset and glue and what is supplied on the command line, an error will be reported when the output is subsequently assessed, e.g., using dnsviz-grok(1).
In lieu of specifying the record data itself on the command line, a file may be specified, which contains the delegation NS and glue records for the domain.
The DS records themselves are specified using the the textual representation of their record data. For example the following DS records for example.com:
31589 8 1 3490A6806D47F17A34C29E2CE80E8A999FFBE4BE
31589 8 2 CDE0D742D6998AA554A92D890F8184C698CFAC8A26FA59875A990C03 E576343C
would be specified by passing this value to -D:
31589 8 2 CDE0D742D6998AA554A92D890F8184C698CFAC8A26FA59875A990C03
E576343C"
In lieu of specifying the record data itself on the command line, a file may be specified, which contains the DS records. For example:
This option must be used in conjunction with the -N option.
If the -c option is not used, the default behavior is for a DNS client cookie to be generated randomly to be sent with queries. If an empty string is specified, then DNS cookies are disabled.
If this option is used, each server probed will be queried with "future" EDNS settings, the respective responses can later be assessed for proper behavior. These settings include future EDNS versions (i.e., > 0), unknown options, and unknown flags.
The exit codes are:
dnsviz(1), dnsviz-grok(1), dnsviz-graph(1), dnsviz-print(1), dnsviz-query(1)
25 Jan 2019 | 0.8.0 |