1DNSSEC-DSFROMKEY(8)                 BIND 9                 DNSSEC-DSFROMKEY(8)
2
3
4

NAME

6       dnssec-dsfromkey - DNSSEC DS RR generation tool
7

SYNOPSIS

9       dnssec-dsfromkey  [  -1  | -2 | -a alg ] [ -C ] [-T TTL] [-v level] [-K
10       directory] {keyfile}
11
12       dnssec-dsfromkey [ -1 | -2 | -a alg ] [ -C ] [-T TTL]  [-v  level]  [-c
13       class] [-A] {-f file} [dnsname]
14
15       dnssec-dsfromkey  [  -1  | -2 | -a alg ] [ -C ] [-T TTL] [-v level] [-c
16       class] [-K directory] {-s} {dnsname}
17
18       dnssec-dsfromkey [ -h | -V ]
19

DESCRIPTION

21       The dnssec-dsfromkey command outputs DS  (Delegation  Signer)  resource
22       records (RRs), or CDS (Child DS) RRs with the -C option.
23
24       The input keys can be specified in a number of ways:
25
26       By  default,  dnssec-dsfromkey  reads  a  key  file named in the format
27       Knnnn.+aaa+iiiii.key, as generated by dnssec-keygen.
28
29       With the -f file option, dnssec-dsfromkey reads keys from a  zone  file
30       or partial zone file (which can contain just the DNSKEY records).
31
32       With the -s option, dnssec-dsfromkey reads a keyset- file, as generated
33       by dnssec-keygen -C.
34

OPTIONS

36       -1     This option is an abbreviation for -a SHA1.
37
38       -2     This option is an abbreviation for -a SHA-256.
39
40       -a algorithm
41              This option specifies a digest algorithm to use when  converting
42              DNSKEY  records  to  DS records. This option can be repeated, so
43              that multiple DS records are created for each DNSKEY record.
44
45              The algorithm must be one of SHA-1, SHA-256, or  SHA-384.  These
46              values  are  case-insensitive, and the hyphen may be omitted. If
47              no algorithm is specified, the default is SHA-256.
48
49       -A     This option indicates that ZSKs are to be included when generat‐
50              ing  DS  records.  Without this option, only keys which have the
51              KSK flag set are converted to DS records and printed.  This  op‐
52              tion is only useful in -f zone file mode.
53
54       -c class
55              This option specifies the DNS class; the default is IN. This op‐
56              tion is only useful in -s keyset or -f zone file mode.
57
58       -C     This option generates CDS records rather than DS records.
59
60       -f file
61              This option sets zone file mode, in which the final dnsname  ar‐
62              gument  of  dnssec-dsfromkey  is  the  DNS domain name of a zone
63              whose master file can be read from file. If the zone name is the
64              same as file, then it may be omitted.
65
66              If  file  is -, then the zone data is read from the standard in‐
67              put. This makes it possible to use the output of the dig command
68              as input, as in:
69
70              dig dnskey example.com | dnssec-dsfromkey -f - example.com
71
72       -h     This option prints usage information.
73
74       -K directory
75              This  option tells BIND 9 to look for key files or keyset- files
76              in directory.
77
78       -s     This option enables keyset mode, in which the final dnsname  ar‐
79              gument  from dnssec-dsfromkey is the DNS domain name used to lo‐
80              cate a keyset- file.
81
82       -T TTL This option specifies the TTL of the DS records. By default  the
83              TTL is omitted.
84
85       -v level
86              This option sets the debugging level.
87
88       -V     This option prints version information.
89

EXAMPLE

91       To  build  the  SHA-256 DS RR from the Kexample.com.+003+26160 keyfile,
92       issue the following command:
93
94       dnssec-dsfromkey -2 Kexample.com.+003+26160
95
96       The command returns something similar to:
97
98       example.com.         IN         DS          26160          5          2
99       3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94
100

FILES

102       The  keyfile can be designated by the key identification Knnnn.+aaa+ii‐
103       iii or  the  full  file  name  Knnnn.+aaa+iiiii.key,  as  generated  by
104       dnssec-keygen.
105
106       The  keyset  file name is built from the directory, the string keyset-,
107       and the dnsname.
108

CAVEAT

110       A keyfile error may return "file not found," even if the file exists.
111

SEE ALSO

113       dnssec-keygen(8), dnssec-signzone(8), BIND  9  Administrator  Reference
114       Manual,  RFC  3658  (DS  RRs),  RFC 4509 (SHA-256 for DS RRs), RFC 6605
115       (SHA-384 for DS RRs), RFC 7344 (CDS and CDNSKEY RRs).
116

AUTHOR

118       Internet Systems Consortium
119

121       2021, Internet Systems Consortium
122
123
124
125
1269.16.23-RH                                                 DNSSEC-DSFROMKEY(8)
Impressum