DNSSEC-DSFROMKEY(1)

📦
version 9.20.30 · 36 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, nixos 26.05, nixpkgs unstable

🎀 DNSSEC-DSFROMKEY(1) 🎀

okay bestie, so this is dnssec-dsfromkey, and it lives in the BIND 9 section of the manual (section 1, for the normies keeping score). It is literally the DNSSEC DS RR generation tool — the little machine that turns your keys into DS records, and honestly? iconic.

✨ NAME ✨

dnssec-dsfromkey — the DNSSEC DS RR generation tool. that's it, that's the vibe 💅

🦋 SYNOPSIS 🦋

dnssec-dsfromkey [ -1 | -2 | -a alg ] [ -C ] [-T TTL] [-v level] [-K directory] {keyfile}

dnssec-dsfromkey [ -1 | -2 | -a alg ] [ -C ] [-T TTL] [-v level] [-c class] [-A] {-f file} [dnsname]

dnssec-dsfromkey [ -1 | -2 | -a alg ] [ -C ] [-T TTL] [-v level] [-c class] [-K directory] {-s} {dnsname}

dnssec-dsfromkey [ -h | -V ]

like, pick a lane, there are four of them 💀

🌸 DESCRIPTION 🌸

so dnssec-dsfromkey outputs DS (Delegation Signer) resource records — RRs, if you're fancy — or CDS (Child DS) RRs when you hit it with the -C option. no cap, that's the whole job.

by default, only KSKs get converted (those are the keys with flags = 257). the -A option brings ZSKs along too (flags = 256). and revoked keys? never included. not on our watch. 🙈

now, the input keys can show up in a few different ways:

  • by default, dnssec-dsfromkey reads a key file named in the format Knnnn.+aaa+iiiii.key, as generated by dnssec-keygen <# std-iscman-dnssec-keygen>.
  • with the -f file option, dnssec-dsfromkey reads keys from a zone file or partial zone file (which can contain just the DNSKEY records, bestie, it doesn't need the whole thing).
  • with the -s option, dnssec-dsfromkey reads a keyset- file, as generated by dnssec-keygen <#std-iscman-dnssec-keygen> -C.

💖 OPTIONS 💖

  • -1 — this option is an abbreviation for -a SHA1. heads up though: this digest is deprecated. it's giving legacy behavior, use it with caution 🫶
  • -2 — this option is an abbreviation for -a SHA-256. the good one. the default one. slay.
  • -a algorithm — this option specifies a digest algorithm to use when converting DNSKEY records to DS records. plot twist: this option can be repeated, so that multiple DS records are created for each DNSKEY record.

the algorithm must be one of SHA-1 (deprecated), SHA-256, or SHA-384. these values are case-insensitive, and the hyphen may be omitted. if no algorithm is specified, the default is SHA-256. periodt.

  • -A — this option indicates that ZSKs are to be included when generating DS records. without this option, only keys which have the KSK flag set are converted to DS records and printed. ngl this option is only useful in -f zone file mode.
  • -c class — this option specifies the DNS class; the default is IN. lowkey this one is only useful in -s keyset or -f zone file mode.
  • -C — this option generates CDS records rather than DS records. child DS, main character energy.
  • -f file — this option sets zone file mode, in which the final dnsname argument of dnssec-dsfromkey is the DNS domain name of a zone whose master file can be read from file. if the zone name is the same as file, then it may be omitted — cute.

if file is -, then the zone data is read from the standard input. this makes it possible to use the output of the dig <# std-iscman-dig> command as input, as in:

dig dnskey example.com | dnssec-dsfromkey -f - example.com
  • -h — this option prints usage information. the "help me help you" button.
  • -K directory — this option tells BIND 9 to look for key files or keyset- files in directory.
  • -s — this option enables keyset mode, in which the final dnsname argument from dnssec-dsfromkey is the DNS domain name used to locate a keyset- file.
  • -T TTL — this option specifies the TTL of the DS records. by default the TTL is omitted. it's mysterious like that ✨
  • -v level — this option sets the debugging level. turn it up when things get weird.
  • -V — this option prints version information. hi, what's your sign, what version are you on 💅

🔥 EXAMPLE 🔥

to build the SHA-256 DS RR from the Kexample.com.+003+26160 keyfile, issue the following command:

dnssec-dsfromkey -2 Kexample.com.+003+26160

the command returns something similar to:

example.com. IN DS 26160 5 2
3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94

look at that hex string go. obsessed. 🔥

🧚 FILES 🧚

the keyfile can be designated by the key identification Knnnn.+aaa+iiiii or the full file name Knnnn.+aaa+iiiii.key, as generated by dnssec-keygen <#std-iscman-dnssec-keygen>.

the keyset file name is built from the directory, the string keyset-, and the dnsname. that's the whole recipe 🍓

💀 CAVEAT 💀

a keyfile error may return "file not found," even if the file exists. yeah. i know. i know. it's giving gaslighting, but it's in the manual so we accept it 😭

🌈 SEE ALSO 🌈

all the required reading. iykyk 📚

👑 Author 👑

Internet Systems Consortium

2026, Internet Systems Consortium

and that's the whole page bestie, go forth and generate those DS records responsibly 🫶

🌸 okurrr, that was DNSSEC-DSFROMKEY(1) from BIND 9, version 9.20.30, dated 2026-10-12. mwah, bye! 💖

📦 where this page comes from