1DNSSEC-IMPORTKEY(8)                 BIND 9                 DNSSEC-IMPORTKEY(8)
2
3
4

NAME

6       dnssec-importkey  - import DNSKEY records from external systems so they
7       can be managed
8

SYNOPSIS

10       dnssec-importkey [-K directory] [-L  ttl]  [-P  date/offset]  [-P  sync
11       date/offset]  [-D  date/offset]  [-D  sync date/offset] [-h] [-v level]
12       [-V] {keyfile}
13
14       dnssec-importkey {-f filename} [-K directory] [-L ttl] [-P date/offset]
15       [-P  sync  date/offset] [-D date/offset] [-D sync date/offset] [-h] [-v
16       level] [-V] [dnsname]
17

DESCRIPTION

19       dnssec-importkey reads a public DNSKEY record and generates a  pair  of
20       .key/.private  files.  The  DNSKEY  record may be read from an existing
21       .key file, in which case a corresponding .private file is generated, or
22       it may be read from any other file or from the standard input, in which
23       case both .key and .private files are generated.
24
25       The newly created .private file does not contain private key data,  and
26       cannot  be  used  for signing. However, having a .private file makes it
27       possible to set publication (-P) and deletion (-D) times for  the  key,
28       which  means the public key can be added to and removed from the DNSKEY
29       RRset on schedule even if the true private key is stored offline.
30

OPTIONS

32       -f filename
33              This option indicates the zone file mode. Instead  of  a  public
34              keyfile name, the argument is the DNS domain name of a zone mas‐
35              ter file, which can be read from filename. If the domain name is
36              the same as filename, then it may be omitted.
37
38              If  filename  is set to "-", then the zone data is read from the
39              standard input.
40
41       -K directory
42              This option sets the directory in which the key files are to re‐
43              side.
44
45       -L ttl This  option sets the default TTL to use for this key when it is
46              converted into a DNSKEY RR. This is the TTL used when the key is
47              imported into a zone, unless there was already a DNSKEY RRset in
48              place, in which case the existing TTL takes precedence.  Setting
49              the default TTL to 0 or none removes it from the key.
50
51       -h     This option emits a usage message and exits.
52
53       -v level
54              This option sets the debugging level.
55
56       -V     This option prints version information.
57

TIMING OPTIONS

59       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
60       argument begins with a + or -, it is interpreted as an offset from  the
61       present  time. For convenience, if such an offset is followed by one of
62       the suffixes y, mo, w, d, h, or mi, then  the  offset  is  computed  in
63       years  (defined  as 365 24-hour days, ignoring leap years), months (de‐
64       fined as 30 24-hour days), weeks,  days,  hours,  or  minutes,  respec‐
65       tively. Without a suffix, the offset is computed in seconds. To explic‐
66       itly prevent a date from being set, use none or never.
67
68       -P date/offset
69              This option sets the date on which a key is to be  published  to
70              the  zone.  After that date, the key is included in the zone but
71              is not used to sign it.
72
73       -P sync date/offset
74              This option sets the date on which CDS and CDNSKEY records  that
75              match this key are to be published to the zone.
76
77       -D date/offset
78              This option sets the date on which the key is to be deleted. Af‐
79              ter that date, the key is no longer included in the zone.  (How‐
80              ever, it may remain in the key repository.)
81
82       -D sync date/offset
83              This  option  sets the date on which the CDS and CDNSKEY records
84              that match this key are to be deleted.
85

FILES

87       A keyfile can be designed by the key identification Knnnn.+aaa+iiiii or
88       the full file name Knnnn.+aaa+iiiii.key, as generated by dnssec-keygen.
89

SEE ALSO

91       dnssec-keygen(8),  dnssec-signzone(8),  BIND  9 Administrator Reference
92       Manual, RFC 5011.
93

AUTHOR

95       Internet Systems Consortium
96
98       2021, Internet Systems Consortium
99
100
101
102
1039.16.23-RH                                                 DNSSEC-IMPORTKEY(8)
Impressum