Man page - dnst-signzone(1)

Packages contas this manual

Manual

DNST-SIGNZONE(1) dnst DNST-SIGNZONE(1)

dnst-signzone - Sign the zone with the given key(s)

dnst signzone [OPTIONS] -o <ORIGIN> <ZONEFILE> <KEY>...

dnst signzone signs the zonefile with the given key(s).

Signing a zone adds DNS Security Extensions (DNSSEC) resource records

Keys must be specified by their base name (usually K<name>+<alg>+<id>), i.e. WITHOUT the .private or .key extension. Both .private and .key files are required.

<ZONEFILE>
The zonefile to sign. Any existing NSEC(3) and/or RRSIG resource records will be skipped when loading the file.

<KEY>...
The keys to sign the zonefile with.

Do not add used keys to the resulting zonefile.

Set the expiration date of signatures to this date (see DATES). Defaults to 4 weeks from now.

Write signed zone to file. Use -f - to output to stdout. Defaults to <ZONEFILE>.signed.

Set the inception date of signatures to this date (see DATES). Defaults to now.

Use this owner name as the apex of the zone. Mandatory.

Set SOA serial to the number of seconds since Jan 1st 1970.

If this would NOT result in the SOA serial increasing it will be incremented instead.


Use NSEC3 instead of NSEC. By default, RFC 9276 best practice settings are used: SHA-1, no extra iterations, empty salt. To use different NSEC3 settings see NSEC3 options.

Sign DNSKEYs with all keys instead of the minimal set.

Sign with every unique algorithm in the provided keys.

Add a ZONEMD resource record. Accepts both mnemonics and numbers. This option can be provided more than once to add multiple ZONEMD RRs. However, only one per scheme-hash tuple will be added. 
HASH supports SHA384 (1) and SHA512 (2).
SCHEME supports SIMPLE (1), the default.


Allow adding ZONEMD RRs without signing the zone. With this option, the <KEY>... argument becomes optional and determines whether to sign the zone.

Hash only, don't sign. With this option, the normally mandatory <KEY>... argument can be omitted.

Print the help text (short summary with -h, long help with --help).

The following options can be used to affect the format of the output.

Add comments on DNSSEC records. Without this option only DNSKEY RRs will have their key tag annotated in the comment.

Preceed the zone output by a list that contains the NSEC3 hashes of the original ownernames.

Order NSEC3 RRs by unhashed owner name.

Order RRSIG RRs by the record type that they cover.

Output YYYYMMDDHHmmSS RRSIG timestamps instead of seconds since epoch.

The following options can be used with -n to override the default NSEC3 settings used.

Specify the salt as a hex string. Defaults to -, meaning empty salt.

Set the number of extra hash iterations. Defaults to 0.

Set the opt-out flag on all NSEC3 RRs.

Set the opt-out flag on all NSEC3 RRs and skip unsigned delegations.

A date can be a UNIX timestamp as seconds since the Epoch (1970-01-01 00:00 UTC), or of the form <YYYYMMdd[hhmmss]>.

NLnet Labs

2024–2026, NLnet Labs

March 5, 2026 0.2.0-alpha1