Man page - dnssec-revoke(1)

Packages contains this manual

Package:  bind9-utils
apt-get install bind9-utils

Manuals in package:
• dnssec-dsfromkey(1)
• named-makejournal(1)
• dnssec-settime(1)
• named-checkconf(1)
• dnssec-revoke(1)
• named-checkzone(1)
• dnssec-ksr(1)
• dnssec-cds(1)
• dnssec-keyfromlabel(1)
• dnssec-signzone(1)
• dnssec-verify(1)
• rndc-confgen(8)
• dnssec-keygen(1)
• rndc(8)
• named-compilezone(1)
Documentations in package:
• bind9-utils

Manual

DNSSEC-REVOKE

NAME
SYNOPSIS
DESCRIPTION
OPTIONS
SEE ALSO
Author
Copyright

---

NAME

dnssec-revoke - set the REVOKED bit on a DNSSEC key

SYNOPSIS

dnssec-revoke [ -hr ] [ -v level] [ -V ] [ -K directory] [ -f ] [ -R ] {keyfile}

DESCRIPTION

dnssec-revoke reads a DNSSEC key file, sets the REVOKED bit on the key as defined in RFC 5011 <https://datatracker.ietf.org/doc/html/rfc5011 .html>, and creates a new pair of key files containing the now-revoked key.

OPTIONS

-h

This option emits a usage message and exits.

-K directory

This option sets the directory in which the key files are to reside.

-r

This option indicates to remove the original keyset files after writing the new keyset files.

-v level

This option sets the debugging level.

	-V		This option prints version information.
	-f		This option indicates a forced overwrite and causes dnssec-revoke to write the new key pair, even if a file already exists matching the algorithm and key ID of the revoked key.
	-R		This option prints the key tag of the key with the REVOKE bit set, but does not revoke the key.

SEE ALSO

dnssec-keygen(8) <#std-iscman-dnssec-keygen>, BIND 9 Administrator Reference Manual, RFC 5011 <https://datatracker.ietf.org/doc/html/ rfc5011.html>.

Author

Internet Systems Consortium

Copyright

2026, Internet Systems Consortium

---