Several commands manipulate the DNSSEC keys and options for zones. Some of these commands require an
ALGORITHM to be set. The following algorithms are supported:
• rsasha1
• rsasha1-nsec3-sha1
• rsasha256
• rsasha512
• ecdsa256
• ecdsa384
• ed25519
• ed448
activate-zone-keyZONEKEY-ID
Activate a key with id KEY-ID within a zone called ZONE.
add-zone-key ZONE [KSK,ZSK] [active,inactive] [published,unpublished] KEYBITSALGORITHM
Create a new key for zone ZONE, and make it a KSK or a ZSK (default), with the specified
algorithm. The key is inactive by default, set it to active to immediately use it to sign ZONE.
The key is published in the zone by default, set it to unpublished to keep it from being returned
in a DNSKEY query, which is useful for algorithm rollovers. Prints the id of the added key.
create-bind-dbFILE
Create DNSSEC database (sqlite3) at FILE for the BIND backend. Remember to set
bind-dnssec-db=*FILE* in your pdns.conf.
deactivate-zone-keyZONEKEY-ID
Deactivate a key with id KEY-ID within a zone called ZONE.
disable-dnssecZONE
Deactivate all keys and unset PRESIGNED in ZONE.
export-zone-dnskeyZONEKEY-ID
Export to standard output DNSKEY and DS of key with key id KEY-ID within zone called ZONE.
export-zone-dsZONE
Export to standard output all KSK DS records for ZONE.
export-zone-keyZONEKEY-ID
Export to standard output full (private) key with key id KEY-ID within zone called ZONE. The
format used is compatible with BIND and NSD/LDNS.
export-zone-key-pemZONEKEY-ID
Export to standard output full (private) key with key id KEY-ID within zone called ZONE in the PEM
file format. The format is compatible with many non-DNS software products.
generate-zone-key {KSK,ZSK} [ALGORITHM] [KEYBITS]
Generate a ZSK or KSK to stdout with specified algorithm and bits and print it on STDOUT. If
ALGORITHM is not set, ECDSA256 is used. If KEYBITS is not set, an appropriate keysize is selected
for ALGORITHM. Each ECC-based algorithm supports only one valid KEYBITS value: For ECDSA256 and
ED25519, it is 256; for ECDSA384, it is 384; and for ED448, it is 456.
import-zone-key ZONEFILE {KSK,ZSK}
Import from FILE a full (private) key for the zone called ZONE. The format used is compatible with
BIND and NSD/LDNS. KSK or ZSK specifies the flags this key should have on import. Prints the id of
the added key.
import-zone-key-pem ZONEFILEALGORITHM {KSK,**ZSK**}
Import from PEM FILE a full (private) key for the zone called ZONE with a specified ALGORITHM. The
format used is compatible with many non-DNS software products. KSK or ZSK specifies the flags this
key should have on import. Prints the id of the added key.
publish-zone-keyZONEKEY-ID
Publish the key with id KEY-ID within a zone called ZONE.
remove-zone-keyZONEKEY-ID
Remove a key with id KEY-ID from a zone called ZONE.
set-nsec3 ZONE ['HASH-ALGORITHMFLAGSITERATIONSSALT'] [narrow]
Sets NSEC3 parameters for this zone. The quoted parameters are 4 values that are used for the
NSEC3PARAM record and decide how NSEC3 records are created. The NSEC3 parameters must be quoted on
the command line. HASH-ALGORITHM must be 1 (SHA-1). Setting FLAGS to 1 enables NSEC3 opt-out
operation. Only do this if you know you need it. For ITERATIONS, please consult RFC 5155, section
10.3. And be aware that a high number might overload validating resolvers and that a limit can be
set with max-nsec3-iterations in pdns.conf. The SALT is a hexadecimal string encoding the bits for
the salt, or - to use no salt. Setting narrow will make PowerDNS send out "white lies" (RFC 7129)
about the next secure record to prevent zone enumeration. Instead of looking it up in the
database, it will send out the hash + 1 as the next secure record. Narrow mode requires online
signing capabilities by the nameserver and therefore zone transfers are denied. If only the zone
is provided as argument, the 4-parameter quoted string defaults to '100-'. A sample commandline
is: pdnsutilset-nsec3powerdnssec.org'111ab'narrow. WARNING: If running in RSASHA1 mode
(algorithm 5 or 7), switching from NSEC to NSEC3 will require a DS update in the parent zone.
unpublish-zone-keyZONEKEY-ID
Unpublish the key with id KEY-ID within a zone called ZONE.
unset-nsec3ZONE
Converts ZONE to NSEC operations. WARNING: If running in RSASHA1 mode (algorithm 5 or 7),
switching from NSEC to NSEC3 will require a DS update at the parent zone!
set-publish-cdsZONE[DIGESTALGOS]
Set ZONE to respond to queries for its CDS records. the optional argument DIGESTALGOS should be a
comma-separated list of DS algorithms to use. By default, this is 2 (SHA-256). 0 will publish a
CDS with a DNSSEC delete algorithm.
set-publish-cdnskey ZONE [delete]
Set ZONE to publish CDNSKEY records. Add 'delete' to publish a CDNSKEY with a DNSSEC delete
algorithm.
unset-publish-cdsZONE
Set ZONE to stop responding to queries for its CDS records.
unset-publish-cdnskeyZONE
Set ZONE to stop publishing CDNSKEY records.
Install Now
PNG Icons