.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man v6.0.2 (Pod::Simple 3.45)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\"
.\" Required to disable full justification in groff 1.23.0.
.if n .ds AD l
.\" ========================================================================
.\"
.IX Title "KRFCHECK 1"
.TH KRFCHECK 1 2025-08-31 "perl v5.42.0" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
krfcheck \- Check a DNSSEC\-Tools keyrec file for problems and
inconsistencies
.SH SYNOPSIS
.IX Header "SYNOPSIS"
.Vb 2
\&  krfcheck [\-zone | \-set | \-key] [\-count] [\-quiet]
\&           [\-verbose] [\-Version] [\-help] keyrec\-file
.Ve
.SH DESCRIPTION
.IX Header "DESCRIPTION"
This script checks a \fIkeyrec\fR file for problems, potential problems,
and inconsistencies.
.PP
Recognized problems include:
.IP \(bu 4
no zones defined
.Sp
The \fIkeyrec\fR file does not contain any zone \fIkeyrec\fRs.
.IP \(bu 4
no sets defined
.Sp
The \fIkeyrec\fR file does not contain any set \fIkeyrec\fRs.
.IP \(bu 4
no keys defined
.Sp
The \fIkeyrec\fR file does not contain any key \fIkeyrec\fRs.
.IP \(bu 4
unknown zone \fIkeyrec\fRs
.Sp
A set \fIkeyrec\fR or a key \fIkeyrec\fR references a non\-existent zone \fIkeyrec\fR.
.IP \(bu 4
missing key from zone \fIkeyrec\fR
.Sp
A zone \fIkeyrec\fR does not have both a KSK key and a ZSK key.
.IP \(bu 4
missing key from set \fIkeyrec\fR
.Sp
A key listed in a set \fIkeyrec\fR does not have a key \fIkeyrec\fR.
.IP \(bu 4
expired zone \fIkeyrec\fRs
.Sp
A zone has expired.
.IP \(bu 4
mislabeled key
.Sp
A key is labeled as a KSK (or ZSK) and its owner zone has it labeled as the
opposite.
.IP \(bu 4
invalid zone data values
.Sp
A zone\*(Aqs \fIkeyrec\fR data are checked to ensure that they are valid.  The
following conditions are checked:  existence of the zone file, existence of
the KSK file, existence of the KSK and ZSK directories, the end\-time is
greater than one day, and the seconds\-count and date string match.
.IP \(bu 4
invalid key data values
.Sp
A key\*(Aqs \fIkeyrec\fR data are checked to ensure that they are valid.  The
following conditions are checked:  valid encryption algorithm, key length
falls within algorithm\*(Aqs size range, random generator file exists, and the
seconds\-count and date string match.
.PP
Recognized potential problems include:
.IP \(bu 4
imminent zone expiration
.Sp
A zone will expire within one week.
.IP \(bu 4
odd zone\-signing date
.Sp
A zone\*(Aqs recorded signing date is later than the current system clock.
.IP \(bu 4
orphaned keys
.Sp
A key \fIkeyrec\fR is unreferenced by any set \fIkeyrec\fR.
.IP \(bu 4
missing key directories
.Sp
A zone \fIkeyrec\fR\*(Aqs key directories (\fIkskdirectory\fR or \fIzskdirectory\fR) does
not exist.
.PP
Recognized inconsistencies include:
.IP \(bu 4
key\-specific fields in a zone \fIkeyrec\fR
.Sp
A zone \fIkeyrec\fR contains key\-specific entries.  To allow for site\-specific
extensibility, \fBkrfcheck\fR does not check for undefined \fIkeyrec\fR fields.
.IP \(bu 4
zone\-specific fields in a key \fIkeyrec\fR
.Sp
A key \fIkeyrec\fR contains zone\-specific entries.  To allow for site\-specific
extensibility, \fBkrfcheck\fR does not check for undefined \fIkeyrec\fR fields.
.IP \(bu 4
mismatched zone timestamp
.Sp
A zone\*(Aqs seconds\-count timestamp does not match its textual timestamp.
.IP \(bu 4
mismatched set timestamp
.Sp
A set\*(Aqs seconds\-count timestamp does not match its textual timestamp.
.IP \(bu 4
mismatched key timestamp
.Sp
A key\*(Aqs seconds\-count timestamp does not match its textual timestamp.
.SH OPTIONS
.IX Header "OPTIONS"
.IP \fB\-zone\fR 4
.IX Item "-zone"
Only perform checks of zone \fIkeyrec\fRs.  This option may not be combined with
the \fB\-set\fR or \fB\-key\fR options.
.IP \fB\-set\fR 4
.IX Item "-set"
Only perform checks of set \fIkeyrec\fRs.  This option may not be combined with
the \fB\-zone\fR or \fB\-key\fR options.
.IP \fB\-key\fR 4
.IX Item "-key"
Only perform checks of key \fIkeyrec\fRs.  This option may not be combined with
the \fB\-set\fR or \fB\-zone\fR options.
.IP \fB\-count\fR 4
.IX Item "-count"
Display a final count of errors.
.IP \fB\-quiet\fR 4
.IX Item "-quiet"
Do not display messages.  This option supersedes the setting of the \fB\-verbose\fR
option.
.IP \fB\-verbose\fR 4
.IX Item "-verbose"
Display many messages.  This option is subordinate to the \fB\-quiet\fR option.
.IP \fB\-Version\fR 4
.IX Item "-Version"
Displays the version information for \fBkrfcheck\fR and the DNSSEC\-Tools package.
.IP \fB\-help\fR 4
.IX Item "-help"
Display a usage message.
.SH COPYRIGHT
.IX Header "COPYRIGHT"
Copyright 2004\-2014 SPARTA, Inc.  All rights reserved.
See the COPYING file included with the DNSSEC\-Tools package for details.
.SH AUTHOR
.IX Header "AUTHOR"
Wayne Morrison, tewok@tislabs.com
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fBcleankrf\|(8)\fR,
\&\fBfixkrf\|(8)\fR,
\&\fBlskrf\|(1)\fR,
\&\fBzonesigner\|(8)\fR
.PP
\&\fBNet::DNS::SEC::Tools::keyrec.pm\|(3)\fR
.PP
\&\fBfile\-keyrec\|(5)\fR