---
name: "dnssec-checkds"
section: "8"
platform: "macos"
package: "bind9"
version: "65"
release: "macOS 26.5"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/dnssec-checkds"
---

# dnssec-checkds(8)

DNSSEC delegation consistency checking tool

## NAME

dnssec-checkds - DNSSEC delegation consistency checking tool

## SYNOPSIS

**dnssec-checkds** \[**-l** *domain*\] \[**-f** *file*\] \[**-d** *dig path*\] \[**-D** *dsfromkey path*\] {zone}

**dnssec-dsfromkey** \[**-l** *domain*\] \[**-f** *file*\] \[**-d** *dig path*\] \[**-D** *dsfromkey path*\] {zone}

## DESCRIPTION

**dnssec-checkds** verifies the correctness of Delegation Signer (DS) or DNSSEC Lookaside Validation (DLV) resource records for keys in a specified zone.

## OPTIONS

- \-f *file*

  If a **file** is specified, then the zone is read from that file to find the DNSKEY records. If not, then the DNSKEY records for the zone are looked up in the DNS.

- \-l *domain*

  Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone's parent. For example, to check for DLV records for "example.com" in ISC's DLV zone, use: **dnssec-checkds -l dlv.isc.org example.com**

\-d *dig path*

Specifies a path to a **dig** binary. Used for testing.

\-D *dsfromkey path*

Specifies a path to a **dnssec-dsfromkey** binary. Used for testing.

## SEE ALSO

[**dnssec-dsfromkey**(8)](/dnssec-dsfromkey/8.md), [**dnssec-keygen**(8)](/dnssec-keygen/8.md), [**dnssec-signzone**(8)](/dnssec-signzone/8.md),

## AUTHOR

**Internet Systems Consortium, Inc.**

## COPYRIGHT

Copyright © 2012-2016 Internet Systems Consortium, Inc. ("ISC")\