1DNSSEC-IMPORTKEY(8) BIND 9 DNSSEC-IMPORTKEY(8)
2
6 dnssec-importkey - import DNSKEY records from external systems so they
7 can be managed
8
10 dnssec-importkey [-K directory] [-L ttl] [-P date/offset] [-P sync
11 date/offset] [-D date/offset] [-D sync date/offset] [-h] [-v level]
12 [-V] {keyfile}
13 dnssec-importkey {-f filename} [-K directory] [-L ttl] [-P date/offset]
15 [-P sync date/offset] [-D date/offset] [-D sync date/offset] [-h] [-v
16 level] [-V] [dnsname]
17
19 dnssec-importkey reads a public DNSKEY record and generates a pair of
20 .key/.private files. The DNSKEY record may be read from an existing
21 .key file, in which case a corresponding .private file is generated, or
22 it may be read from any other file or from the standard input, in which
23 case both .key and .private files are generated.
24 The newly created .private file does not contain private key data, and
26 cannot be used for signing. However, having a .private file makes it
27 possible to set publication (-P) and deletion (-D) times for the key,
28 which means the public key can be added to and removed from the DNSKEY
29 RRset on schedule even if the true private key is stored offline.
30
32 -f filename
33 This option indicates the zone file mode. Instead of a public
34 keyfile name, the argument is the DNS domain name of a zone mas‐
35 ter file, which can be read from filename. If the domain name is
36 the same as filename, then it may be omitted.
37 If filename is set to "-", then the zone data is read from the
39 standard input.
40 -K directory
42 This option sets the directory in which the key files are to re‐
43 side.
44 -L ttl This option sets the default TTL to use for this key when it is
46 converted into a DNSKEY RR. This is the TTL used when the key is
47 imported into a zone, unless there was already a DNSKEY RRset in
48 place, in which case the existing TTL takes precedence. Setting
49 the default TTL to 0 or none removes it from the key.
50 -h This option emits a usage message and exits.
52 -v level
54 This option sets the debugging level.
55 -V This option prints version information.
57
59 Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
60 argument begins with a + or -, it is interpreted as an offset from the
61 present time. For convenience, if such an offset is followed by one of
62 the suffixes y, mo, w, d, h, or mi, then the offset is computed in
63 years (defined as 365 24-hour days, ignoring leap years), months (de‐
64 fined as 30 24-hour days), weeks, days, hours, or minutes, respec‐
65 tively. Without a suffix, the offset is computed in seconds. To explic‐
66 itly prevent a date from being set, use none or never.
67 -P date/offset
69 This option sets the date on which a key is to be published to
70 the zone. After that date, the key is included in the zone but
71 is not used to sign it.
72 -P sync date/offset
74 This option sets the date on which CDS and CDNSKEY records that
75 match this key are to be published to the zone.
76 -D date/offset
78 This option sets the date on which the key is to be deleted. Af‐
79 ter that date, the key is no longer included in the zone. (How‐
80 ever, it may remain in the key repository.)
81 -D sync date/offset
83 This option sets the date on which the CDS and CDNSKEY records
84 that match this key are to be deleted.
85
87 A keyfile can be designed by the key identification Knnnn.+aaa+iiiii or
88 the full file name Knnnn.+aaa+iiiii.key, as generated by dnssec-keygen.
89
91 dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference
92 Manual, RFC 5011.
93
95 Internet Systems Consortium
96
98 2022, Internet Systems Consortium
999.16.30-RH DNSSEC-IMPORTKEY(8)