1DNSSEC-SIGNZONE(8) BIND9 DNSSEC-SIGNZONE(8)
2
6 dnssec-signzone - DNSSEC zone signing tool
7
9 dnssec-signzone [-a] [-c class] [-d directory] [-D] [-E engine]
10 [-e end-time] [-f output-file] [-g] [-h] [-i interval]
11 [-I input-format] [-j jitter] [-K directory] [-k key]
12 [-L serial] [-l domain] [-M maxttl]
13 [-N soa-serial-format] [-o origin] [-O output-format]
14 [-P] [-p] [-Q] [-R] [-r randomdev] [-S] [-s start-time]
15 [-T ttl] [-t] [-u] [-v level] [-V]
16 [-X extended end-time] [-x] [-z] [-3 salt]
17 [-H iterations] [-A] {zonefile} [key...]
18
20 dnssec-signzone signs a zone. It generates NSEC and RRSIG records and
21 produces a signed version of the zone. The security status of
22 delegations from the signed zone (that is, whether the child zones are
23 secure or not) is determined by the presence or absence of a keyset
24 file for each child zone.
25
27 -a
28 Verify all generated signatures.
29 -c class
31 Specifies the DNS class of the zone.
32 -C
34 Compatibility mode: Generate a keyset-zonename file in addition to
35 dsset-zonename when signing a zone, for use by older versions of
36 dnssec-signzone.
37 -d directory
39 Look for dsset- or keyset- files in directory.
40 -D
42 Output only those record types automatically managed by
43 dnssec-signzone, i.e. RRSIG, NSEC, NSEC3 and NSEC3PARAM records. If
44 smart signing (-S) is used, DNSKEY records are also included. The
45 resulting file can be included in the original zone file with
46 $INCLUDE. This option cannot be combined with -O raw, -O map, or
47 serial number updating.
48 -E engine
50 When applicable, specifies the hardware to use for cryptographic
51 operations, such as a secure key store used for signing.
52 When BIND is built with OpenSSL PKCS#11 support, this defaults to
54 the string "pkcs11", which identifies an OpenSSL engine that can
55 drive a cryptographic accelerator or hardware service module. When
56 BIND is built with native PKCS#11 cryptography
57 (--enable-native-pkcs11), it defaults to the path of the PKCS#11
58 provider library specified via "--with-pkcs11".
59 -g
61 Generate DS records for child zones from dsset- or keyset- file.
62 Existing DS records will be removed.
63 -K directory
65 Key repository: Specify a directory to search for DNSSEC keys. If
66 not specified, defaults to the current directory.
67 -k key
69 Treat specified key as a key signing key ignoring any key flags.
70 This option may be specified multiple times.
71 -l domain
73 Generate a DLV set in addition to the key (DNSKEY) and DS sets. The
74 domain is appended to the name of the records.
75 -M maxttl
77 Sets the maximum TTL for the signed zone. Any TTL higher than
78 maxttl in the input zone will be reduced to maxttl in the output.
79 This provides certainty as to the largest possible TTL in the
80 signed zone, which is useful to know when rolling keys because it
81 is the longest possible time before signatures that have been
82 retrieved by resolvers will expire from resolver caches. Zones that
83 are signed with this option should be configured to use a matching
84 max-zone-ttl in named.conf. (Note: This option is incompatible with
85 -D, because it modifies non-DNSSEC data in the output zone.)
86 -s start-time
88 Specify the date and time when the generated RRSIG records become
89 valid. This can be either an absolute or relative time. An absolute
90 start time is indicated by a number in YYYYMMDDHHMMSS notation;
91 20000530144500 denotes 14:45:00 UTC on May 30th, 2000. A relative
92 start time is indicated by +N, which is N seconds from the current
93 time. If no start-time is specified, the current time minus 1 hour
94 (to allow for clock skew) is used.
95 -e end-time
97 Specify the date and time when the generated RRSIG records expire.
98 As with start-time, an absolute time is indicated in YYYYMMDDHHMMSS
99 notation. A time relative to the start time is indicated with +N,
100 which is N seconds from the start time. A time relative to the
101 current time is indicated with now+N. If no end-time is specified,
102 30 days from the start time is used as a default. end-time must be
103 later than start-time.
104 -X extended end-time
106 Specify the date and time when the generated RRSIG records for the
107 DNSKEY RRset will expire. This is to be used in cases when the
108 DNSKEY signatures need to persist longer than signatures on other
109 records; e.g., when the private component of the KSK is kept
110 offline and the KSK signature is to be refreshed manually.
111 As with start-time, an absolute time is indicated in YYYYMMDDHHMMSS
113 notation. A time relative to the start time is indicated with +N,
114 which is N seconds from the start time. A time relative to the
115 current time is indicated with now+N. If no extended end-time is
116 specified, the value of end-time is used as the default. (end-time,
117 in turn, defaults to 30 days from the start time.) extended
118 end-time must be later than start-time.
119 -f output-file
121 The name of the output file containing the signed zone. The default
122 is to append .signed to the input filename. If output-file is set
123 to "-", then the signed zone is written to the standard output,
124 with a default output format of "full".
125 -h
127 Prints a short summary of the options and arguments to
128 dnssec-signzone.
129 -V
131 Prints version information.
132 -i interval
134 When a previously-signed zone is passed as input, records may be
135 resigned. The interval option specifies the cycle interval as an
136 offset from the current time (in seconds). If a RRSIG record
137 expires after the cycle interval, it is retained. Otherwise, it is
138 considered to be expiring soon, and it will be replaced.
139 The default cycle interval is one quarter of the difference between
141 the signature end and start times. So if neither end-time or
142 start-time are specified, dnssec-signzone generates signatures that
143 are valid for 30 days, with a cycle interval of 7.5 days.
144 Therefore, if any existing RRSIG records are due to expire in less
145 than 7.5 days, they would be replaced.
146 -I input-format
148 The format of the input zone file. Possible formats are "text"
149 (default), "raw", and "map". This option is primarily intended to
150 be used for dynamic signed zones so that the dumped zone file in a
151 non-text format containing updates can be signed directly. The use
152 of this option does not make much sense for non-dynamic zones.
153 -j jitter
155 When signing a zone with a fixed signature lifetime, all RRSIG
156 records issued at the time of signing expires simultaneously. If
157 the zone is incrementally signed, i.e. a previously-signed zone is
158 passed as input to the signer, all expired signatures have to be
159 regenerated at about the same time. The jitter option specifies a
160 jitter window that will be used to randomize the signature expire
161 time, thus spreading incremental signature regeneration over time.
162 Signature lifetime jitter also to some extent benefits validators
164 and servers by spreading out cache expiration, i.e. if large
165 numbers of RRSIGs don't expire at the same time from all caches
166 there will be less congestion than if all validators need to
167 refetch at mostly the same time.
168 -L serial
170 When writing a signed zone to "raw" or "map" format, set the
171 "source serial" value in the header to the specified serial number.
172 (This is expected to be used primarily for testing purposes.)
173 -n ncpus
175 Specifies the number of threads to use. By default, one thread is
176 started for each detected CPU.
177 -N soa-serial-format
179 The SOA serial number format of the signed zone. Possible formats
180 are "keep" (default), "increment", "unixtime", and "date".
181 "keep"
183 Do not modify the SOA serial number.
184 "increment"
186 Increment the SOA serial number using RFC 1982 arithmetics.
187 "unixtime"
189 Set the SOA serial number to the number of seconds since epoch.
190 "date"
192 Set the SOA serial number to today's date in YYYYMMDDNN format.
193 -o origin
195 The zone origin. If not specified, the name of the zone file is
196 assumed to be the origin.
197 -O output-format
199 The format of the output file containing the signed zone. Possible
200 formats are "text" (default), which is the standard textual
201 representation of the zone; "full", which is text output in a
202 format suitable for processing by external scripts; and "map",
203 "raw", and "raw=N", which store the zone in binary formats for
204 rapid loading by named. "raw=N" specifies the format version of
205 the raw zone file: if N is 0, the raw file can be read by any
206 version of named; if N is 1, the file can be read by release 9.9.0
207 or higher; the default is 1.
208 -p
210 Use pseudo-random data when signing the zone. This is faster, but
211 less secure, than using real random data. This option may be useful
212 when signing large zones or when the entropy source is limited.
213 -P
215 Disable post sign verification tests.
216 The post sign verification test ensures that for each algorithm in
218 use there is at least one non revoked self signed KSK key, that all
219 revoked KSK keys are self signed, and that all records in the zone
220 are signed by the algorithm. This option skips these tests.
221 -Q
223 Remove signatures from keys that are no longer active.
224 Normally, when a previously-signed zone is passed as input to the
226 signer, and a DNSKEY record has been removed and replaced with a
227 new one, signatures from the old key that are still within their
228 validity period are retained. This allows the zone to continue to
229 validate with cached copies of the old DNSKEY RRset. The -Q forces
230 dnssec-signzone to remove signatures from keys that are no longer
231 active. This enables ZSK rollover using the procedure described in
232 RFC 4641, section 4.2.1.1 ("Pre-Publish Key Rollover").
233 -R
235 Remove signatures from keys that are no longer published.
236 This option is similar to -Q, except it forces dnssec-signzone to
238 signatures from keys that are no longer published. This enables ZSK
239 rollover using the procedure described in RFC 4641, section 4.2.1.2
240 ("Double Signature Zone Signing Key Rollover").
241 -r randomdev
243 Specifies the source of randomness. If the operating system does
244 not provide a /dev/random or equivalent device, the default source
245 of randomness is keyboard input. randomdev specifies the name of a
246 character device or file containing random data to be used instead
247 of the default. The special value keyboard indicates that keyboard
248 input should be used.
249 -S
251 Smart signing: Instructs dnssec-signzone to search the key
252 repository for keys that match the zone being signed, and to
253 include them in the zone if appropriate.
254 When a key is found, its timing metadata is examined to determine
256 how it should be used, according to the following rules. Each
257 successive rule takes priority over the prior ones:
258 If no timing metadata has been set for the key, the key is
260 published in the zone and used to sign the zone.
261 If the key's publication date is set and is in the past, the
263 key is published in the zone.
264 If the key's activation date is set and in the past, the key is
266 published (regardless of publication date) and used to sign the
267 zone.
268 If the key's revocation date is set and in the past, and the
270 key is published, then the key is revoked, and the revoked key
271 is used to sign the zone.
272 If either of the key's unpublication or deletion dates are set
274 and in the past, the key is NOT published or used to sign the
275 zone, regardless of any other metadata.
276 -T ttl
278 Specifies a TTL to be used for new DNSKEY records imported into the
279 zone from the key repository. If not specified, the default is the
280 TTL value from the zone's SOA record. This option is ignored when
281 signing without -S, since DNSKEY records are not imported from the
282 key repository in that case. It is also ignored if there are any
283 pre-existing DNSKEY records at the zone apex, in which case new
284 records' TTL values will be set to match them, or if any of the
285 imported DNSKEY records had a default TTL value. In the event of a
286 a conflict between TTL values in imported keys, the shortest one is
287 used.
288 -t
290 Print statistics at completion.
291 -u
293 Update NSEC/NSEC3 chain when re-signing a previously signed zone.
294 With this option, a zone signed with NSEC can be switched to NSEC3,
295 or a zone signed with NSEC3 can be switch to NSEC or to NSEC3 with
296 different parameters. Without this option, dnssec-signzone will
297 retain the existing chain when re-signing.
298 -v level
300 Sets the debugging level.
301 -x
303 Only sign the DNSKEY RRset with key-signing keys, and omit
304 signatures from zone-signing keys. (This is similar to the
305 dnssec-dnskey-kskonly yes; zone option in named.)
306 -z
308 Ignore KSK flag on key when determining what to sign. This causes
309 KSK-flagged keys to sign all records, not just the DNSKEY RRset.
310 (This is similar to the update-check-ksk no; zone option in named.)
311 -3 salt
313 Generate an NSEC3 chain with the given hex encoded salt. A dash
314 (salt) can be used to indicate that no salt is to be used when
315 generating the NSEC3 chain.
316 -H iterations
318 When generating an NSEC3 chain, use this many iterations. The
319 default is 10.
320 -A
322 When generating an NSEC3 chain set the OPTOUT flag on all NSEC3
323 records and do not generate NSEC3 records for insecure delegations.
324 Using this option twice (i.e., -AA) turns the OPTOUT flag off for
326 all records. This is useful when using the -u option to modify an
327 NSEC3 chain which previously had OPTOUT set.
328 zonefile
330 The file containing the zone to be signed.
331 key
333 Specify which keys should be used to sign the zone. If no keys are
334 specified, then the zone will be examined for DNSKEY records at the
335 zone apex. If these are found and there are matching private keys,
336 in the current directory, then these will be used for signing.
337
339 The following command signs the example.com zone with the DSA key
340 generated by dnssec-keygen (Kexample.com.+003+17247). Because the -S
341 option is not being used, the zone's keys must be in the master file
342 (db.example.com). This invocation looks for dsset files, in the current
343 directory, so that DS records can be imported from them (-g).
344 % dnssec-signzone -g -o example.com db.example.com \
346 Kexample.com.+003+17247
347 db.example.com.signed
348 %
349 In the above example, dnssec-signzone creates the file
351 db.example.com.signed. This file should be referenced in a zone
352 statement in a named.conf file.
353 This example re-signs a previously signed zone with default parameters.
355 The private keys are assumed to be in the current directory.
356 % cp db.example.com.signed db.example.com
358 % dnssec-signzone -o example.com db.example.com
359 db.example.com.signed
360 %
361
363 dnssec-keygen(8), BIND 9 Administrator Reference Manual, RFC 4033, RFC
364 4641.
365
367 Internet Systems Consortium, Inc.
368
370 Copyright © 2000-2009, 2011-2021 Internet Systems Consortium, Inc.
371 ("ISC")
372ISC 2014-02-18 DNSSEC-SIGNZONE(8)