]>
Commit | Line | Data |
---|---|---|
1 | <?xml version='1.0'?> | |
2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" | |
3 | "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> | |
4 | ||
5 | <!-- | |
6 | This file is part of systemd. | |
7 | ||
8 | Copyright 2016 Lennart Poettering | |
9 | ||
10 | systemd is free software; you can redistribute it and/or modify it | |
11 | under the terms of the GNU Lesser General Public License as published by | |
12 | the Free Software Foundation; either version 2.1 of the License, or | |
13 | (at your option) any later version. | |
14 | ||
15 | systemd is distributed in the hope that it will be useful, but | |
16 | WITHOUT ANY WARRANTY; without even the implied warranty of | |
17 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
18 | Lesser General Public License for more details. | |
19 | ||
20 | You should have received a copy of the GNU Lesser General Public License | |
21 | along with systemd; If not, see <http://www.gnu.org/licenses/>. | |
22 | --> | |
23 | ||
24 | <refentry id="systemd-resolve" conditional='ENABLE_RESOLVE' | |
25 | xmlns:xi="http://www.w3.org/2001/XInclude"> | |
26 | ||
27 | <refentryinfo> | |
28 | <title>systemd-resolve</title> | |
29 | <productname>systemd</productname> | |
30 | ||
31 | <authorgroup> | |
32 | <author> | |
33 | <contrib>Developer</contrib> | |
34 | <firstname>Lennart</firstname> | |
35 | <surname>Poettering</surname> | |
36 | <email>lennart@poettering.net</email> | |
37 | </author> | |
38 | </authorgroup> | |
39 | </refentryinfo> | |
40 | ||
41 | <refmeta> | |
42 | <refentrytitle>systemd-resolve</refentrytitle> | |
43 | <manvolnum>1</manvolnum> | |
44 | </refmeta> | |
45 | ||
46 | <refnamediv> | |
47 | <refname>systemd-resolve</refname> | |
48 | <refpurpose>Resolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services</refpurpose> | |
49 | </refnamediv> | |
50 | ||
51 | <refsynopsisdiv> | |
52 | <cmdsynopsis> | |
53 | <command>systemd-resolve</command> | |
54 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
55 | <arg choice="plain" rep="repeat"><replaceable>HOSTNAME</replaceable></arg> | |
56 | </cmdsynopsis> | |
57 | ||
58 | <cmdsynopsis> | |
59 | <command>systemd-resolve</command> | |
60 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
61 | <arg choice="plain" rep="repeat"><replaceable>ADDRESS</replaceable></arg> | |
62 | </cmdsynopsis> | |
63 | ||
64 | <cmdsynopsis> | |
65 | <command>systemd-resolve</command> | |
66 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
67 | <command> --type=<replaceable>TYPE</replaceable></command> | |
68 | <arg choice="plain" rep="repeat"><replaceable>DOMAIN</replaceable></arg> | |
69 | </cmdsynopsis> | |
70 | ||
71 | <cmdsynopsis> | |
72 | <command>systemd-resolve</command> | |
73 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
74 | <command> --service</command> | |
75 | <arg choice="plain"><arg choice="opt"><arg choice="opt"><replaceable>NAME</replaceable></arg> | |
76 | <replaceable>TYPE</replaceable></arg> <replaceable>DOMAIN</replaceable></arg> | |
77 | </cmdsynopsis> | |
78 | ||
79 | <cmdsynopsis> | |
80 | <command>systemd-resolve</command> | |
81 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
82 | <command> --openpgp</command> | |
83 | <arg choice="plain"><replaceable>USER@DOMAIN</replaceable></arg> | |
84 | </cmdsynopsis> | |
85 | ||
86 | <cmdsynopsis> | |
87 | <command>systemd-resolve</command> | |
88 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
89 | <command> --tlsa</command> | |
90 | <arg choice="plain"><replaceable>DOMAIN<optional>:PORT</optional></replaceable></arg> | |
91 | </cmdsynopsis> | |
92 | ||
93 | <cmdsynopsis> | |
94 | <command>systemd-resolve</command> | |
95 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
96 | <command> --statistics</command> | |
97 | </cmdsynopsis> | |
98 | ||
99 | <cmdsynopsis> | |
100 | <command>systemd-resolve</command> | |
101 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
102 | <command> --reset-statistics</command> | |
103 | </cmdsynopsis> | |
104 | ||
105 | </refsynopsisdiv> | |
106 | ||
107 | <refsect1> | |
108 | <title>Description</title> | |
109 | ||
110 | <para><command>systemd-resolve</command> may be used to resolve domain names, IPv4 and IPv6 addresses, DNS resource | |
111 | records and services with the | |
112 | <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> | |
113 | resolver service. By default, the specified list of parameters will be resolved as hostnames, retrieving their IPv4 | |
114 | and IPv6 addresses. If the parameters specified are formatted as IPv4 or IPv6 operation the reverse operation is | |
115 | done, and a hostname is retrieved for the specified addresses.</para> | |
116 | ||
117 | <para>The program's output contains information about the protocol used for the look-up and on which network | |
118 | interface the data was discovered. It also contains information on whether the information could be | |
119 | authenticated. All data for which local DNSSEC validation succeeds is considered authenticated. Moreover all data | |
120 | originating from local, trusted sources is also reported authenticated, including resolution of the local host | |
121 | name, the <literal>localhost</literal> host name or all data from <filename>/etc/hosts</filename>.</para> | |
122 | ||
123 | <para>The <option>--type=</option> switch may be used to specify a DNS resource record type (A, AAAA, SOA, MX, …) in | |
124 | order to request a specific DNS resource record, instead of the address or reverse address lookups. | |
125 | The special value <literal>help</literal> may be used to list known values.</para> | |
126 | ||
127 | <para>The <option>--service</option> switch may be used to resolve <ulink | |
128 | url="https://tools.ietf.org/html/rfc2782">SRV</ulink> and <ulink | |
129 | url="https://tools.ietf.org/html/rfc6763">DNS-SD</ulink> services (see below). In this mode, between one and three | |
130 | arguments are required. If three parameters are passed the first is assumed to be the DNS-SD service name, the | |
131 | second the SRV service type, and the third the domain to search in. In this case a full DNS-SD style SRV and TXT | |
132 | lookup is executed. If only two parameters are specified, the first is assumed to be the SRV service type, and the | |
133 | second the domain to look in. In this case no TXT RR is requested. Finally, if only one parameter is specified, it | |
134 | is assumed to be a domain name, that is already prefixed with an SRV type, and an SRV lookup is done (no | |
135 | TXT).</para> | |
136 | ||
137 | <para>The <option>--openpgp</option> switch may be used to query PGP keys stored as | |
138 | <ulink url="https://tools.ietf.org/html/rfc7929">OPENPGPKEY</ulink> resource records. | |
139 | When this option is specified one or more e-mail address must be specified.</para> | |
140 | ||
141 | <para>The <option>--tlsa</option> switch maybe be used to query TLS public | |
142 | keys stored as | |
143 | <ulink url="https://tools.ietf.org/html/rfc6698">TLSA</ulink> resource records. | |
144 | When this option is specified one or more domain names must be specified.</para> | |
145 | ||
146 | <para>The <option>--statistics</option> switch may be used to show resolver statistics, including information about | |
147 | the number of successful and failed DNSSEC validations.</para> | |
148 | ||
149 | <para>The <option>--reset-statistics</option> may be used to reset various statistics counters maintained the | |
150 | resolver, including those shown in the <option>--statistics</option> output. This operation requires root | |
151 | privileges.</para> | |
152 | </refsect1> | |
153 | ||
154 | <refsect1> | |
155 | <title>Options</title> | |
156 | <variablelist> | |
157 | <varlistentry> | |
158 | <term><option>-4</option></term> | |
159 | <term><option>-6</option></term> | |
160 | ||
161 | <listitem><para>By default, when resolving a hostname, both IPv4 and IPv6 | |
162 | addresses are acquired. By specifying <option>-4</option> only IPv4 addresses are requested, by specifying | |
163 | <option>-6</option> only IPv6 addresses are requested.</para> | |
164 | </listitem> | |
165 | </varlistentry> | |
166 | ||
167 | <varlistentry> | |
168 | <term><option>-i</option> <replaceable>INTERFACE</replaceable></term> | |
169 | <term><option>--interface=</option><replaceable>INTERFACE</replaceable></term> | |
170 | ||
171 | <listitem><para>Specifies the network interface to execute the query on. This may either be specified as numeric | |
172 | interface index or as network interface string (e.g. <literal>en0</literal>). Note that this option has no | |
173 | effect if system-wide DNS configuration (as configured in <filename>/etc/resolv.conf</filename> or | |
174 | <filename>/etc/systemd/resolve.conf</filename>) in place of per-link configuration is used.</para></listitem> | |
175 | </varlistentry> | |
176 | ||
177 | <varlistentry> | |
178 | <term><option>-p</option> <replaceable>PROTOCOL</replaceable></term> | |
179 | <term><option>--protocol=</option><replaceable>PROTOCOL</replaceable></term> | |
180 | ||
181 | <listitem><para>Specifies the network protocol for the query. May be one of <literal>dns</literal> | |
182 | (i.e. classic unicast DNS), <literal>llmnr</literal> (<ulink | |
183 | url="https://tools.ietf.org/html/rfc4795">Link-Local Multicast Name Resolution</ulink>), | |
184 | <literal>llmnr-ipv4</literal>, <literal>llmnr-ipv6</literal> (LLMNR via the indicated underlying IP | |
185 | protocols), <literal>mdns</literal> (<ulink url="https://www.ietf.org/rfc/rfc6762.txt">Multicast DNS</ulink>), | |
186 | <literal>mdns-ipv4</literal>, <literal>mdns-ipv6</literal> (MDNS via the indicated underlying IP protocols). | |
187 | By default the lookup is done via all protocols suitable for the lookup. If used, limits the set of | |
188 | protocols that may be used. Use this option multiple times to enable resolving via multiple protocols at the | |
189 | same time. The setting <literal>llmnr</literal> is identical to specifying this switch once with | |
190 | <literal>llmnr-ipv4</literal> and once via <literal>llmnr-ipv6</literal>. Note that this option does not force | |
191 | the service to resolve the operation with the specified protocol, as that might require a suitable network | |
192 | interface and configuration. | |
193 | The special value <literal>help</literal> may be used to list known values. | |
194 | </para></listitem> | |
195 | </varlistentry> | |
196 | ||
197 | <varlistentry> | |
198 | <term><option>-t</option> <replaceable>TYPE</replaceable></term> | |
199 | <term><option>--type=</option><replaceable>TYPE</replaceable></term> | |
200 | <term><option>-c</option> <replaceable>CLASS</replaceable></term> | |
201 | <term><option>--class=</option><replaceable>CLASS</replaceable></term> | |
202 | ||
203 | <listitem><para>Specifies the DNS resource record type (e.g. A, AAAA, MX, …) and class (e.g. IN, ANY, …) to | |
204 | look up. If these options are used a DNS resource record set matching the specified class and type is | |
205 | requested. The class defaults to IN if only a type is specified. | |
206 | The special value <literal>help</literal> may be used to list known values. | |
207 | </para></listitem> | |
208 | </varlistentry> | |
209 | ||
210 | <varlistentry> | |
211 | <term><option>--service</option></term> | |
212 | ||
213 | <listitem><para>Enables service resolution. This enables DNS-SD and simple SRV service resolution, depending | |
214 | on the specified list of parameters (see above).</para></listitem> | |
215 | </varlistentry> | |
216 | ||
217 | <varlistentry> | |
218 | <term><option>--service-address=</option><replaceable>BOOL</replaceable></term> | |
219 | ||
220 | <listitem><para>Takes a boolean parameter. If true (the default), when doing a service lookup with | |
221 | <option>--service</option> the hostnames contained in the SRV resource records are resolved as well.</para></listitem> | |
222 | </varlistentry> | |
223 | ||
224 | <varlistentry> | |
225 | <term><option>--service-txt=</option><replaceable>BOOL</replaceable></term> | |
226 | ||
227 | <listitem><para>Takes a boolean parameter. If true (the default), when doing a DNS-SD service lookup with | |
228 | <option>--service</option> the TXT service metadata record is resolved as well.</para></listitem> | |
229 | </varlistentry> | |
230 | ||
231 | <varlistentry> | |
232 | <term><option>--openpgp</option></term> | |
233 | ||
234 | <listitem><para>Enables OPENPGPKEY resource record resolution (see above). Specified e-mail | |
235 | addresses are converted to the corresponding DNS domain name, and any OPENPGPKEY keys are | |
236 | printed.</para></listitem> | |
237 | </varlistentry> | |
238 | ||
239 | <varlistentry> | |
240 | <term><option>--tlsa</option></term> | |
241 | ||
242 | <listitem><para>Enables TLSA resource record resolution (see above). | |
243 | A query will be performed for each of the specified names prefixed with | |
244 | the port and family | |
245 | (<literal>_<replaceable>port</replaceable>._<replaceable>family</replaceable>.<replaceable>domain</replaceable></literal>). | |
246 | The port number may be specified after a colon | |
247 | (<literal>:</literal>), otherwise <constant>443</constant> will be used | |
248 | by default. The family may be specified as an argument after | |
249 | <option>--tlsa</option>, otherwise <constant>tcp</constant> will be | |
250 | used.</para></listitem> | |
251 | </varlistentry> | |
252 | ||
253 | <varlistentry> | |
254 | <term><option>--cname=</option><replaceable>BOOL</replaceable></term> | |
255 | ||
256 | <listitem><para>Takes a boolean parameter. If true (the default), DNS CNAME or DNAME redirections are | |
257 | followed. Otherwise, if a CNAME or DNAME record is encountered while resolving, an error is | |
258 | returned.</para></listitem> | |
259 | </varlistentry> | |
260 | ||
261 | <varlistentry> | |
262 | <term><option>--search=</option><replaceable>BOOL</replaceable></term> | |
263 | ||
264 | <listitem><para>Takes a boolean parameter. If true (the default), any specified single-label hostnames will be | |
265 | searched in the domains configured in the search domain list, if it is non-empty. Otherwise, the search domain | |
266 | logic is disabled.</para></listitem> | |
267 | </varlistentry> | |
268 | ||
269 | <varlistentry> | |
270 | <term><option>--raw</option><optional>=payload|packet</optional></term> | |
271 | ||
272 | <listitem><para>Dump the answer as binary data. If there is no argument or if the argument is | |
273 | <literal>payload</literal>, the payload of the packet is exported. If the argument is | |
274 | <literal>packet</literal>, the whole packet is dumped in wire format, prefixed by | |
275 | length specified as a little-endian 64-bit number. This format allows multiple packets | |
276 | to be dumped and unambiguously parsed.</para></listitem> | |
277 | </varlistentry> | |
278 | ||
279 | <varlistentry> | |
280 | <term><option>--legend=</option><replaceable>BOOL</replaceable></term> | |
281 | ||
282 | <listitem><para>Takes a boolean parameter. If true (the default), column headers and meta information about the | |
283 | query response are shown. Otherwise, this output is suppressed.</para></listitem> | |
284 | </varlistentry> | |
285 | ||
286 | <varlistentry> | |
287 | <term><option>--statistics</option></term> | |
288 | ||
289 | <listitem><para>If specified general resolver statistics are shown, including information whether DNSSEC is | |
290 | enabled and available, as well as resolution and validation statistics.</para></listitem> | |
291 | </varlistentry> | |
292 | ||
293 | <varlistentry> | |
294 | <term><option>--reset-statistics</option></term> | |
295 | ||
296 | <listitem><para>Resets the statistics counters shown in <option>--statistics</option> to zero.</para></listitem> | |
297 | </varlistentry> | |
298 | ||
299 | <varlistentry> | |
300 | <term><option>--flush-caches</option></term> | |
301 | ||
302 | <listitem><para>Flushes all DNS resource record caches the service maintains locally.</para></listitem> | |
303 | </varlistentry> | |
304 | ||
305 | <varlistentry> | |
306 | <term><option>--status</option></term> | |
307 | ||
308 | <listitem><para>Shows the global and per-link DNS settings in currently in effect.</para></listitem> | |
309 | </varlistentry> | |
310 | ||
311 | <xi:include href="standard-options.xml" xpointer="help" /> | |
312 | <xi:include href="standard-options.xml" xpointer="version" /> | |
313 | <xi:include href="standard-options.xml" xpointer="no-pager" /> | |
314 | </variablelist> | |
315 | </refsect1> | |
316 | ||
317 | <refsect1> | |
318 | <title>Examples</title> | |
319 | ||
320 | <example> | |
321 | <title>Retrieve the addresses of the <literal>www.0pointer.net</literal> domain</title> | |
322 | ||
323 | <programlisting>$ systemd-resolve www.0pointer.net | |
324 | www.0pointer.net: 2a01:238:43ed:c300:10c3:bcf3:3266:da74 | |
325 | 85.214.157.71 | |
326 | ||
327 | -- Information acquired via protocol DNS in 611.6ms. | |
328 | -- Data is authenticated: no | |
329 | </programlisting> | |
330 | </example> | |
331 | ||
332 | <example> | |
333 | <title>Retrieve the domain of the <literal>85.214.157.71</literal> IP address</title> | |
334 | ||
335 | <programlisting>$ systemd-resolve 85.214.157.71 | |
336 | 85.214.157.71: gardel.0pointer.net | |
337 | ||
338 | -- Information acquired via protocol DNS in 1.2997s. | |
339 | -- Data is authenticated: no | |
340 | </programlisting> | |
341 | </example> | |
342 | ||
343 | <example> | |
344 | <title>Retrieve the MX record of the <literal>yahoo.com</literal> domain</title> | |
345 | ||
346 | <programlisting>$ systemd-resolve -t MX yahoo.com --legend=no | |
347 | yahoo.com. IN MX 1 mta7.am0.yahoodns.net | |
348 | yahoo.com. IN MX 1 mta6.am0.yahoodns.net | |
349 | yahoo.com. IN MX 1 mta5.am0.yahoodns.net | |
350 | </programlisting> | |
351 | </example> | |
352 | ||
353 | <example> | |
354 | <title>Resolve an SRV service</title> | |
355 | ||
356 | <programlisting>$ systemd-resolve --service _xmpp-server._tcp gmail.com | |
357 | _xmpp-server._tcp/gmail.com: alt1.xmpp-server.l.google.com:5269 [priority=20, weight=0] | |
358 | 173.194.210.125 | |
359 | alt4.xmpp-server.l.google.com:5269 [priority=20, weight=0] | |
360 | 173.194.65.125 | |
361 | … | |
362 | </programlisting> | |
363 | </example> | |
364 | ||
365 | <example> | |
366 | <title>Retrieve a PGP key</title> | |
367 | ||
368 | <programlisting>$ systemd-resolve --openpgp zbyszek@fedoraproject.org | |
369 | d08ee310438ca124a6149ea5cc21b6313b390dce485576eff96f8722._openpgpkey.fedoraproject.org. IN OPENPGPKEY | |
370 | mQINBFBHPMsBEACeInGYJCb+7TurKfb6wGyTottCDtiSJB310i37/6ZYoeIay/5soJjlMyf | |
371 | MFQ9T2XNT/0LM6gTa0MpC1st9LnzYTMsT6tzRly1D1UbVI6xw0g0vE5y2Cjk3xUwAynCsSs | |
372 | … | |
373 | </programlisting> | |
374 | </example> | |
375 | ||
376 | <example> | |
377 | <title>Retrieve a TLS key (<literal>=tcp</literal> and | |
378 | <literal>:443</literal> could be skipped)</title> | |
379 | ||
380 | <programlisting>$ systemd-resolve --tlsa=tcp fedoraproject.org:443 | |
381 | _443._tcp.fedoraproject.org IN TLSA 0 0 1 19400be5b7a31fb733917700789d2f0a2471c0c9d506c0e504c06c16d7cb17c0 | |
382 | -- Cert. usage: CA constraint | |
383 | -- Selector: Full Certificate | |
384 | -- Matching type: SHA-256 | |
385 | </programlisting> | |
386 | </example> | |
387 | </refsect1> | |
388 | ||
389 | <refsect1> | |
390 | <title>See Also</title> | |
391 | <para> | |
392 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, | |
393 | <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> | |
394 | </para> | |
395 | </refsect1> | |
396 | </refentry> |