---
name: "dnssec-checkds"
section: "8"
platform: "linux"
package: "bind9-utils"
version: "1:9.16.50-1~deb11u2"
release: "Debian 11 (Bullseye)"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/dnssec-checkds"
---

# dnssec-checkds(8)

DNSSEC delegation consistency checking tool

## NAME

dnssec-checkds - DNSSEC delegation consistency checking tool

## SYNOPSIS

**dnssec-checkds** \[**-d***dig path*\] \[**-D***dsfromkey path*\] \[**-f***file*\] \[**-l***domain*\] \[**-s***file*\] {zone}

## DESCRIPTION

**dnssec-checkds** verifies the correctness of Delegation Signer (DS) resource records for keys in a specified zone.

## OPTIONS

- **-a** *algorithm*

  Specify a digest algorithm to use when converting the zones DNSKEY records to expected DS records. This option can be repeated, so that multiple records are checked for each DNSKEY record.

  The *algorithm* must be one of SHA-1, SHA-256, or SHA-384. These values are case insensitive, and the hyphen may be omitted. If no algorithm is specified, the default is SHA-256.

- **-f** *file*

  If a **file** is specified, then the zone is read from that file to find the DNSKEY records. If not, then the DNSKEY records for the zone are looked up in the DNS.

- **-s** *file*

  Specifies a prepared dsset file, such as would be generated by **dnssec-signzone**, to use as a source for the DS RRset instead of querying the parent.

**-d** *dig path*

Specifies a path to a **dig** binary. Used for testing.

**-D** *dsfromkey path*

Specifies a path to a **dnssec-dsfromkey** binary. Used for testing.

## SEE ALSO

[**dnssec-dsfromkey**(8)](/dnssec-dsfromkey/8.md), [**dnssec-keygen**(8)](/dnssec-keygen/8.md), [**dnssec-signzone**(8)](/dnssec-signzone/8.md),

## AUTHOR

Internet Systems Consortium

## COPYRIGHT

2024, Internet Systems Consortium