4.18. dnssec-verify --- DNSSEC zone signature verifier

4.18.1. Synopsis

dnssec-verify [-c <class>] [-o <origin>] [-x] [-z] [-v <level>] [-G] [-Y <device>] [-n <workers>] [-t] [-Z async-window-items=N] [-Z async-window-bytes=N] <zonefile>

dnssec-verify [ -h | -V ]

4.18.2. Description

dnssec-verify verifies that a zone is fully signed for each algorithm found in the DNSKEY RRset for the zone, and that the NSEC/NSEC3 chains are complete. This standalone verifier uses asynchronous, bounded batches for ordinary RRset signature checks. Verification runs on CPU by default, and Vulkan GPU acceleration is also supported.

Note

DNSKEY self-signature policy checks and NSEC/NSEC3 chain validation are not part of the async batch counters.

Note

MLDSA44 signatures (DNSSEC algorithm 18) can be verified on platforms with OpenSSL 3.5 or newer.

4.18.3. Options

-c <class>: Specifies the DNS class of the zone.

-o <origin>: The zone origin. If not specified, the name of the zone file is assumed to be the origin.

-x: Only verify that the DNSKEY RRset is signed with key-signing keys. Without this flag, it is assumed that the DNSKEY RRset will be signed by all active keys. When this flag is set, it will not be an error if the DNSKEY RRset is not signed by zone-signing keys. This corresponds to the -x option of dnssec-signzone(1).

-z

Ignore the KSK flag on the keys when determining whether the zone if correctly signed. Without this flag it is assumed that there will be a non-revoked, self-signed DNSKEY with the KSK flag set for each algorithm and that RRsets other than DNSKEY RRset will be signed with a different DNSKEY without the KSK flag set.

With this flag set, we only require that for each algorithm, there will be at least one non-revoked, self-signed DNSKEY, regardless of the KSK flag state, and that other RRsets will be signed by a non-revoked key for the same algorithm that includes the self-signed key; the same key may be used for both purposes. This corresponds to the -z option of dnssec-signzone(1).

-G: Use Vulkan GPU acceleration for DNSSEC verification. If Vulkan cannot be initialized, dnssec-verify prints a warning and continues with CPU-based DNSSEC verification. Without -G or -Y, CPU execution is the default.

-Y <device>

Select a zero-based Vulkan physical-device index and imply -G. The index must be a non-negative integer. If the selected device is unavailable, or if Vulkan startup otherwise fails, verification continues through CPU-based execution after printing a warning.

You can use vulkaninfo(1) to list Vulkan physical devices and their indexes.

$ vulkaninfo --summary

-n <workers>: Number of ISC task-manager workers for parallel canonicalization, hashing, request preparation and asynchronous completion (default 4; range 1 through 128). Verification uses the same task-owned cohort/batch model as dnssec-signzone(1). No dedicated preparation threads are created. The GPU's frame capacity is unchanged.

-t: Print detailed asynchronous DNSSEC verification statistics, including prepared requests, batch sizes, successful and unsuccessful checks, GPU versus CPU/fallback completions, Vulkan dispatches, retained-memory peaks, verification time and verifications per second. These counters cover batched RRset cryptographic verification, not DNSKEY self-signature policy or NSEC/NSEC3 chain checks. With no -t, the concise verification summary is preserved.

-Z async-window-items=<N>: Set an explicit global outstanding-request window in items, using the same option as dnssec-signzone(1). The value must be a positive integer representable as a native size. The window includes queued, preparing and submitted verification checks. Without this option, the window follows the accelerator's frame capacity: four GPU frames plus two frames of producer headroom, subject to executor limits. Without an accelerator, the automatic window is 1024 requests. An explicit value may be larger than one GPU frame; the executor still enforces GPU admission limits and task-owned publication batch sizing.

-Z async-window-bytes=<N>: Set an explicit retained-request memory budget in bytes, using the same option as dnssec-signzone(1). The value must be a positive integer representable as a native size. Without this option, the limit follows the accelerator's BULK retained-byte limit; without an accelerator, it is 64 MiB. The loaded zone database and queued job metadata consume additional memory, so this is not a process RSS limit.

-h: Print program usage information and exit.

-v <level>: Set the verbosity level.

-V: Print program version and exit.

<zonefile>: The file containing the zone to be verified.

4.18.4. See also

dnssec-signzone(1), vulkaninfo(1)