1PDNSUTIL(1) PowerDNS Authoritative Server PDNSUTIL(1)
2
3
4
6 pdnsutil - PowerDNS record and DNSSEC command and control
7
9 pdnsutil [OPTION]... COMMAND
10
12 pdnsutil (formerly pdnssec) is a powerful command that is the opera‐
13 tor-friendly gateway into DNSSEC and zone management for PowerDNS. Be‐
14 hind the scenes, pdnsutil manipulates a PowerDNS backend database,
15 which also means that for many databases, pdnsutil can be run remotely,
16 and can configure key material on different servers.
17
19 -h, --help
20 Show summary of options
21
22 -v, --verbose
23 Be more verbose.
24
25 --force
26 Force an action
27
28 --config-name <NAME>
29 Virtual configuration name
30
31 --config-dir <DIR>
32 Location of pdns.conf. Default is /etc/powerdns.
33
35 There are many available commands, this section splits them up into
36 their respective uses
37
39 Several commands manipulate the DNSSEC keys and options for zones. Some
40 of these commands require an ALGORITHM to be set. The following algo‐
41 rithms are supported:
42
43 • rsasha1
44
45 • rsasha1-nsec3-sha1
46
47 • rsasha256
48
49 • rsasha512
50
51 • ecdsa256
52
53 • ecdsa384
54
55 • ed25519
56
57 • ed448
58
59 activate-zone-key ZONE KEY-ID
60 Activate a key with id KEY-ID within a zone called ZONE.
61
62 add-zone-key ZONE [KSK,ZSK] [active,inactive] [published,unpublished]
63 KEYBITS ALGORITHM
64 Create a new key for zone ZONE, and make it a KSK or a ZSK (de‐
65 fault), with the specified algorithm. The key is inactive by de‐
66 fault, set it to active to immediately use it to sign ZONE. The
67 key is published in the zone by default, set it to unpublished
68 to keep it from being returned in a DNSKEY query, which is use‐
69 ful for algorithm rollovers. Prints the id of the added key.
70
71 create-bind-db FILE
72 Create DNSSEC database (sqlite3) at FILE for the BIND backend.
73 Remember to set bind-dnssec-db=*FILE* in your pdns.conf.
74
75 deactivate-zone-key ZONE KEY-ID
76 Deactivate a key with id KEY-ID within a zone called ZONE.
77
78 disable-dnssec ZONE
79 Deactivate all keys and unset PRESIGNED in ZONE.
80
81 export-zone-dnskey ZONE KEY-ID
82 Export to standard output DNSKEY and DS of key with key id
83 KEY-ID within zone called ZONE.
84
85 export-zone-ds ZONE
86 Export to standard output all KSK DS records for ZONE.
87
88 export-zone-key ZONE KEY-ID
89 Export to standard output full (private) key with key id KEY-ID
90 within zone called ZONE. The format used is compatible with BIND
91 and NSD/LDNS.
92
93 generate-zone-key {KSK,ZSK} [ALGORITHM] [KEYBITS]
94 Generate a ZSK or KSK to stdout with specified algorithm and
95 bits and print it on STDOUT. If ALGORITHM is not set, ECDSA256
96 is used. If KEYBITS is not set, an appropriate keysize is se‐
97 lected for ALGORITHM. Each ECC-based algorithm supports only one
98 valid KEYBITS value: For ECDSA256 and ED25519, it is 256; for
99 ECDSA384, it is 384; and for ED448, it is 456.
100
101 import-zone-key ZONE FILE {KSK,ZSK}
102 Import from FILE a full (private) key for zone called ZONE. The
103 format used is compatible with BIND and NSD/LDNS. KSK or ZSK
104 specifies the flags this key should have on import. Prints the
105 id of the added key.
106
107 publish-zone-key ZONE KEY-ID
108 Publish the key with id KEY-ID within a zone called ZONE.
109
110 remove-zone-key ZONE KEY-ID
111 Remove a key with id KEY-ID from a zone called ZONE.
112
113 set-nsec3 ZONE ['HASH-ALGORITHM FLAGS ITERATIONS SALT'] [narrow]
114 Sets NSEC3 parameters for this zone. The quoted parameters are 4
115 values that are used for the the NSEC3PARAM record and decide
116 how NSEC3 records are created. The NSEC3 parameters must be
117 quoted on the command line. HASH-ALGORITHM must be 1 (SHA-1).
118 Setting FLAGS to 1 enables NSEC3 opt-out operation. Only do this
119 if you know you need it. For ITERATIONS, please consult RFC
120 5155, section 10.3. And be aware that a high number might over‐
121 load validating resolvers and that a limit can be set with
122 max-nsec3-iterations in pdns.conf. The SALT is a hexadecimal
123 string encoding the bits for the salt, or - to use no salt. Set‐
124 ting narrow will make PowerDNS send out "white lies" (RFC 7129)
125 about the next secure record to prevent zone enumeration. In‐
126 stead of looking it up in the database, it will send out the
127 hash + 1 as the next secure record. Narrow mode requires online
128 signing capabilities by the nameserver and therefore zone trans‐
129 fers are denied. If only the zone is provided as argument, the
130 4-parameter quoted string defaults to '1 0 1 ab'. A sample com‐
131 mandline is: pdnsutil set-nsec3 powerdnssec.org '1 1 1 ab' nar‐
132 row. WARNING: If running in RSASHA1 mode (algorithm 5 or 7),
133 switching from NSEC to NSEC3 will require a DS update in the
134 parent zone.
135
136 unpublish-zone-key ZONE KEY-ID
137 Unpublish the key with id KEY-ID within a zone called ZONE.
138
139 unset-nsec3 ZONE
140 Converts ZONE to NSEC operations. WARNING: If running in RSASHA1
141 mode (algorithm 5 or 7), switching from NSEC to NSEC3 will re‐
142 quire a DS update at the parent zone!
143
144 set-publish-cds ZONE [DIGESTALGOS]
145 Set ZONE to respond to queries for its CDS records. the optional
146 argument DIGESTALGOS should be a comma-separated list of DS al‐
147 gorithms to use. By default, this is 2 (SHA-256). 0 will publish
148 a CDS with a DNSSEC delete algorithm.
149
150 set-publish-cdnskey ZONE [delete]
151 Set ZONE to publish CDNSKEY records. Add 'delete' to publish a
152 CDNSKEY with a DNSSEC delete algorithm.
153
154 unset-publish-cds ZONE
155 Set ZONE to stop responding to queries for its CDS records.
156
157 unset-publish-cdnskey ZONE
158 Set ZONE to stop publishing CDNSKEY records.
159
161 These commands manipulate TSIG key information in the database. Some
162 commands require an ALGORITHM, the following are available:
163
164 • hmac-md5
165
166 • hmac-sha1
167
168 • hmac-sha224
169
170 • hmac-sha256
171
172 • hmac-sha384
173
174 • hmac-sha512
175
176 activate-tsig-key ZONE NAME {primary,secondary}
177 Enable TSIG authenticated AXFR using the key NAME for zone ZONE.
178 This sets the TSIG-ALLOW-AXFR (primary) or AXFR-MASTER-TSIG
179 (secondary) zone metadata.
180
181 deactivate-tsig-key ZONE NAME {primary,secondary}
182 Disable TSIG authenticated AXFR using the key NAME for zone
183 ZONE.
184
185 delete-tsig-key NAME
186 Delete the TSIG key NAME. Warning, this does not deactivate said
187 key.
188
189 generate-tsig-key NAME ALGORITHM
190 Generate new TSIG key with name NAME and the specified algo‐
191 rithm.
192
193 import-tsig-key NAME ALGORITHM KEY
194 Import KEY of the specified algorithm as NAME.
195
196 list-tsig-keys
197 Show a list of all configured TSIG keys.
198
200 add-record ZONE NAME TYPE [TTL] CONTENT
201 Add one or more records of NAME and TYPE to ZONE with CONTENT
202 and optional TTL. If TTL is not set, default will be used.
203
204 add-autoprimary IP NAMESERVER [ACCOUNT]
205 Add a autoprimary entry into the backend. This enables receiving
206 zone updates from other servers.
207
208 create-zone ZONE
209 Create an empty zone named ZONE.
210
211 create-secondary-zone ZONE PRIMARY [PRIMARY]..
212 Create a new secondary zone ZONE with primaries PRIMARY. All
213 PRIMARYs need to to be space-separated IP addresses with an op‐
214 tional port.
215
216 change-secondary-zone-primary ZONE PRIMARY [PRIMARY]..
217 Change the primaries for secondary zone ZONE to new primaries
218 PRIMARY. All PRIMARYs need to to be space-separated IP addresses
219 with an optional port.
220
221 check-all-zones
222 Check all zones for correctness.
223
224 check-zone ZONE
225 Check zone ZONE for correctness.
226
227 clear-zone ZONE
228 Clear the records in zone ZONE, but leave actual zone and set‐
229 tings unchanged
230
231 delete-rrset ZONE NAME TYPE
232 Delete named RRSET from zone.
233
234 delete-zone ZONE:
235 Delete the zone named ZONE.
236
237 edit-zone ZONE
238 Opens ZONE in zonefile format (regardless of backend it was
239 loaded from) in the editor set in the environment variable EDI‐
240 TOR. if EDITOR is empty, pdnsutil falls back to using editor.
241
242 get-meta ZONE [ATTRIBUTE]...
243 Get zone metadata. If no ATTRIBUTE given, lists all known.
244
245 hash-zone-record ZONE RNAME
246 This convenience command hashes the name RNAME according to the
247 NSEC3 settings of ZONE. Refuses to hash for zones with no NSEC3
248 settings.
249
250 increase-serial ZONE
251 Increases the SOA-serial by 1. Uses SOA-EDIT.
252
253 list-keys [ZONE]
254 List DNSSEC information for all keys or for ZONE. --verbose or
255 -v will also include the keys for disabled or empty zones.
256
257 list-all-zones:
258 List all active zone names. --verbose or -v will also include
259 disabled or empty zones.
260
261 list-zone ZONE
262 Show all records for ZONE.
263
264 load-zone ZONE FILE
265 Load records for ZONE from FILE. If ZONE already exists, all
266 records are overwritten, this operation is atomic. If ZONE
267 doesn't exist, it is created.
268
269 rectify-zone ZONE
270 Calculates the 'ordername' and 'auth' fields for a zone called
271 ZONE so they comply with DNSSEC settings. Can be used to fix up
272 migrated data. Can always safely be run, it does no harm.
273
274 rectify-all-zones
275 Calculates the 'ordername' and 'auth' fields for all zones so
276 they comply with DNSSEC settings. Can be used to fix up migrated
277 data. Can always safely be run, it does no harm.
278
279 replace-rrset ZONE NAME TYPE [TTL] CONTENT [CONTENT..]
280 Replace existing NAME in zone ZONE with a new set.
281
282 secure-zone ZONE
283 Configures a zone called ZONE with reasonable DNSSEC settings.
284 You should manually run 'pdnsutil rectify-zone' afterwards.
285
286 secure-all-zones [increase-serial]
287 Configures all zones that are not currently signed with reason‐
288 able DNSSEC settings. Setting increase-serial will increase the
289 serial of those zones too. You should manually run 'pdnsutil
290 rectify-all-zones' afterwards.
291
292 set-kind ZONE KIND
293 Change the kind of ZONE to KIND (primary, secondary, native).
294
295 set-account ZONE ACCOUNT
296 Change the account (owner) of ZONE to ACCOUNT.
297
298 add-meta ZONE ATTRIBUTE VALUE [VALUE]...
299 Append VALUE to the existing ATTRIBUTE metadata for ZONE. Will
300 return an error if ATTRIBUTE does not support multiple values,
301 use set-meta for these values.
302
303 set-meta ZONE ATTRIBUTE [VALUE]...
304 Set zonemetadata ATTRIBUTE for ZONE to VALUE. An empty value
305 clears it.
306
307 set-presigned ZONE
308 Switches ZONE to presigned operation, utilizing in-zone RRSIGs.
309
310 show-zone ZONE
311 Shows all DNSSEC related settings of a zone called ZONE.
312
313 test-schema ZONE
314 Test database schema, this creates the zone ZONE
315
316 unset-presigned ZONE
317 Disables presigned operation for ZONE.
318
319 raw-lua-from-content TYPE CONTENT
320 Display record contents in a form suitable for dnsdist's
321 SpoofRawAction.
322
324 backend-cmd BACKEND CMD [CMD..]
325 Send a text command to a backend for execution. GSQL backends
326 will take SQL commands, other backends may take different
327 things. Be careful!
328
329 bench-db [FILE]
330 Perform a benchmark of the backend-database. FILE can be a file
331 with a list, one per line, of zone names to use for this. If
332 FILE is not specified, powerdns.com is used.
333
335 ipencrypt IP-ADDRESS password
336 Encrypt an IP address according to the 'ipcipher' standard
337
338 ipdecrypt IP-ADDRESS password
339 Encrypt an IP address according to the 'ipcipher' standard
340
342 pdns_server (1), pdns_control (1)
343
345 PowerDNS.COM BV
346
348 2001-2021, PowerDNS.COM BV
349
350
351
352
353 Nov 09, 2021 PDNSUTIL(1)