dnssec-dsfromkey(8)

1DNSSEC-DSFROMKEY(8)                  BIND9                 DNSSEC-DSFROMKEY(8)
2
3
4

NAME

6       dnssec-dsfromkey - DNSSEC DS RR generation tool
7

SYNOPSIS

9       dnssec-dsfromkey [-1 | -2 | -a alg] [-C | -l domain] [-T TTL]
10                        [-v level] [-K directory] {keyfile}
11
12       dnssec-dsfromkey [-1 | -2 | -a alg] [-C | -l domain] [-T TTL]
13                        [-v level] [-c class] [-A] {-f file} [dnsname]
14
15       dnssec-dsfromkey [-1 | -2 | -a alg] [-C | -l domain] [-T TTL]
16                        [-v level] [-c class] [-K directory] {-s} {dnsname}
17
18       dnssec-dsfromkey [-h | -V]
19

DESCRIPTION

21       The dnssec-dsfromkey command outputs DS (Delegation Signer) resource
22       records (RRs) and other similarly-constructed RRs: with the -l option
23       it outputs DLV (DNSSEC Lookaside Validation) RRs; or with the -C it
24       outputs CDS (Child DS) RRs.
25
26       The input keys can be specified in a number of ways:
27
28       By default, dnssec-dsfromkey reads a key file named like
29       Knnnn.+aaa+iiiii.key, as generated by dnssec-keygen.
30
31       With the -f file option, dnssec-dsfromkey reads keys from a zone file
32       or partial zone file (which can contain just the DNSKEY records).
33
34       With the -s option, dnssec-dsfromkey reads a keyset- file, as generated
35       by dnssec-keygen-C.
36

OPTIONS

38       -1
39           An abbreviation for -a SHA1
40
41       -2
42           An abbreviation for -a SHA-256
43
44       -a algorithm
45           Specify a digest algorithm to use when converting DNSKEY records to
46           DS records. This option can be repeated, so that multiple DS
47           records are created for each DNSKEY record.
48
49           The algorithm must be one of SHA-1, SHA-256, or SHA-384. These
50           values are case insensitive, and the hyphen may be omitted. If no
51           algorithm is specified, the default is to use both SHA-1 and
52           SHA-256.
53
54       -A
55           Include ZSKs when generating DS records. Without this option, only
56           keys which have the KSK flag set will be converted to DS records
57           and printed. Useful only in -f zone file mode.
58
59       -c class
60           Specifies the DNS class (default is IN). Useful only in -s keyset
61           or -f zone file mode.
62
63       -C
64           Generate CDS records rather than DS records. This is mutually
65           exclusive with the -l option for generating DLV records.
66
67       -f file
68           Zone file mode: dnssec-dsfromkey's final dnsname argument is the
69           DNS domain name of a zone whose master file can be read from file.
70           If the zone name is the same as file, then it may be omitted.
71
72           If file is "-", then the zone data is read from the standard input.
73           This makes it possible to use the output of the dig command as
74           input, as in:
75
76           dig dnskey example.com | dnssec-dsfromkey -f - example.com
77
78       -h
79           Prints usage information.
80
81       -K directory
82           Look for key files or keyset- files in directory.
83
84       -l domain
85           Generate a DLV set instead of a DS set. The specified domain is
86           appended to the name for each record in the set. This is mutually
87           exclusive with the -C option for generating CDS records.
88
89       -s
90           Keyset mode: dnssec-dsfromkey's final dnsname argument is the DNS
91           domain name used to locate a keyset- file.
92
93       -T TTL
94           Specifies the TTL of the DS records. By default the TTL is omitted.
95
96       -v level
97           Sets the debugging level.
98
99       -V
100           Prints version information.
101

EXAMPLE

103       To build the SHA-256 DS RR from the Kexample.com.+003+26160 keyfile
104       name, you can issue the following command:
105
106       dnssec-dsfromkey -2 Kexample.com.+003+26160
107
108       The command would print something like:
109
110       example.com. IN DS 26160 5 2
111       3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94
112

FILES

114       The keyfile can be designated by the key identification
115       Knnnn.+aaa+iiiii or the full file name Knnnn.+aaa+iiiii.key as
116       generated by dnssec-keygen(8).
117
118       The keyset file name is built from the directory, the string keyset-
119       and the dnsname.
120

CAVEAT

122       A keyfile error can give a "file not found" even if the file exists.
123

AUTHOR

130       Internet Systems Consortium, Inc.
131

COPYRIGHT

133       Copyright © 2008-2012, 2014-2016, 2018-2020 Internet Systems
134       Consortium, Inc. ("ISC")
135
136
137
138ISC                               2012-05-02               DNSSEC-DSFROMKEY(8)