.\" Man page generated from reStructuredText.
.
.TH "DNSSEC-DSFROMKEY" "8" "@RELEASE_DATE@" "@BIND9_VERSION@" "BIND 9"
.SH NAME
dnssec-dsfromkey \- DNSSEC DS RR generation tool
.
.nr rst2man-indent-level 0
.
.de1 rstReportMargin
\\$1 \\n[an-margin]
level \\n[rst2man-indent-level]
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
\\n[rst2man-indent0]
\\n[rst2man-indent1]
\\n[rst2man-indent2]
..
.de1 INDENT
.\" .rstReportMargin pre:
. RS \\$1
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
. nr rst2man-indent-level +1
.\" .rstReportMargin post:
..
.de UNINDENT
. RE
.\" indent \\n[an-margin]
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
.nr rst2man-indent-level -1
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.SH SYNOPSIS
.sp
\fBdnssec\-dsfromkey\fP [ \fB\-1\fP | \fB\-2\fP | \fB\-a\fP alg ] [ \fB\-C\fP ] [\fB\-T\fP TTL] [\fB\-v\fP level] [\fB\-K\fP directory] {keyfile}
.sp
\fBdnssec\-dsfromkey\fP [ \fB\-1\fP | \fB\-2\fP | \fB\-a\fP alg ] [ \fB\-C\fP ] [\fB\-T\fP TTL] [\fB\-v\fP level] [\fB\-c\fP class] [\fB\-A\fP] {\fB\-f\fP file} [dnsname]
.sp
\fBdnssec\-dsfromkey\fP [ \fB\-1\fP | \fB\-2\fP | \fB\-a\fP alg ] [ \fB\-C\fP ] [\fB\-T\fP TTL] [\fB\-v\fP level] [\fB\-c\fP class] [\fB\-K\fP directory] {\fB\-s\fP} {dnsname}
.sp
\fBdnssec\-dsfromkey\fP [ \fB\-h\fP | \fB\-V\fP ]
.SH DESCRIPTION
.sp
The \fBdnssec\-dsfromkey\fP command outputs DS (Delegation Signer) resource records
(RRs), or CDS (Child DS) RRs with the \fB\-C\fP option.
.sp
The input keys can be specified in a number of ways:
.sp
By default, \fBdnssec\-dsfromkey\fP reads a key file named like
\fBKnnnn.+aaa+iiiii.key\fP, as generated by \fBdnssec\-keygen\fP\&.
.sp
With the \fB\-f file\fP option, \fBdnssec\-dsfromkey\fP reads keys from a zone
file or partial zone file (which can contain just the DNSKEY records).
.sp
With the \fB\-s\fP option, \fBdnssec\-dsfromkey\fP reads a \fBkeyset\-\fP file,
as generated by \fBdnssec\-keygen\fP \fB\-C\fP\&.
.SH OPTIONS
.INDENT 0.0
.TP
\fB\-1\fP
An abbreviation for \fB\-a SHA1\fP
.TP
\fB\-2\fP
An abbreviation for \fB\-a SHA\-256\fP
.TP
\fB\-a\fP algorithm
Specify a digest algorithm to use when converting DNSKEY records to
DS records. This option can be repeated, so that multiple DS records
are created for each DNSKEY record.
.sp
The algorithm must be one of SHA\-1, SHA\-256, or SHA\-384. These values
are case insensitive, and the hyphen may be omitted. If no algorithm
is specified, the default is SHA\-256.
.TP
\fB\-A\fP
Include ZSKs when generating DS records. Without this option, only
keys which have the KSK flag set will be converted to DS records and
printed. Useful only in \fB\-f\fP zone file mode.
.TP
\fB\-c\fP class
Specifies the DNS class (default is IN). Useful only in \fB\-s\fP keyset
or \fB\-f\fP zone file mode.
.TP
\fB\-C\fP
Generate CDS records rather than DS records.
.TP
\fB\-f\fP file
Zone file mode: \fBdnssec\-dsfromkey\fP\(aqs final dnsname argument is the
DNS domain name of a zone whose master file can be read from
\fBfile\fP\&. If the zone name is the same as \fBfile\fP, then it may be
omitted.
.sp
If file is \fB"\-"\fP, then the zone data is read from the standard
input. This makes it possible to use the output of the \fBdig\fP
command as input, as in:
.sp
\fBdig dnskey example.com | dnssec\-dsfromkey \-f \- example.com\fP
.TP
\fB\-h\fP
Prints usage information.
.TP
\fB\-K\fP directory
Look for key files or \fBkeyset\-\fP files in \fBdirectory\fP\&.
.TP
\fB\-s\fP
Keyset mode: \fBdnssec\-dsfromkey\fP\(aqs final dnsname argument is the DNS
domain name used to locate a \fBkeyset\-\fP file.
.TP
\fB\-T\fP TTL
Specifies the TTL of the DS records. By default the TTL is omitted.
.TP
\fB\-v\fP level
Sets the debugging level.
.TP
\fB\-V\fP
Prints version information.
.UNINDENT
.SH EXAMPLE
.sp
To build the SHA\-256 DS RR from the \fBKexample.com.+003+26160\fP keyfile
name, you can issue the following command:
.sp
\fBdnssec\-dsfromkey \-2 Kexample.com.+003+26160\fP
.sp
The command would print something like:
.sp
\fBexample.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94\fP
.SH FILES
.sp
The keyfile can be designated by the key identification
\fBKnnnn.+aaa+iiiii\fP or the full file name \fBKnnnn.+aaa+iiiii.key\fP as
generated by dnssec\-keygen8.
.sp
The keyset file name is built from the \fBdirectory\fP, the string
\fBkeyset\-\fP and the \fBdnsname\fP\&.
.SH CAVEAT
.sp
A keyfile error can give a "file not found" even if the file exists.
.SH SEE ALSO
.sp
\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
\fI\%RFC 3658\fP (DS RRs), \fI\%RFC 4509\fP (SHA\-256 for DS RRs),
\fI\%RFC 6605\fP (SHA\-384 for DS RRs), \fI\%RFC 7344\fP (CDS and CDNSKEY RRs).
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
2020, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.