DNSSEC-KSR(1)

💅 DNSSEC-KSR(1) — the dnssec-ksr era

okay so first things first, bestie: this is a page from the BIND 9 manual set, and the star of the show is dnssec-ksr. buckle up 🎀

✨ NAME ✨

dnssec-ksr — create signed key response (SKR) files for offline KSK setups 🦋

🌸 SYNOPSIS 🌸

dnssec-ksr [-E engine] [-e date/offset] [-F] [-f file] [-h] [-i
date/offset] [-K directory] [-k policy] [-l file] [-o] [-V] [-v level]
{command} {zone}

👑 DESCRIPTION 👑

so dnssec-ksr is the main character that lets you issue several commands — and those commands are literally what you need to generate presigned RRsets for a zone where the private key file of the Key Signing Key (KSK) is typically offline. yes, offline. the KSK is on airplane mode, living its best life, no cap 💅

this whole setup requires Zone Signing Keys (ZSKs) to be pregenerated, and the DNSKEY, CDNSKEY, and CDS RRsets to be already signed in advance.

and that "in advance" part? that's done by creating Key Signing Requests (KSRs) that can be imported to the environment where the KSK is available 🔥 once they're over there, this program can create Signed Key Responses (SKRs) that can be loaded by an authoritative DNS server. it's giving relay race, honestly 🫶

---

✨ OPTIONS ✨

• -E engine — this option specifies the cryptographic hardware to use, when applicable.

when BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL engine identifier that drives the cryptographic accelerator or hardware service module (usually pkcs11). iykyk 🔑

• -e date/offset — this option sets the end date for which keys or SKRs need to be generated (depending on the command). yes, the end. -e for end, we love a mnemonic 🎀
• -F — this options turns on FIPS (US Federal Information Processing Standards) mode if the underlying crytographic library supports running in FIPS mode.
• -f — this option sets the SKR file to be signed when issuing a sign command. (you'll see it as -f file up in the synopsis 👀)
• -h — this option prints a short summary of the options and arguments to dnssec-ksr. your little emergency exit when you forget everything 🌈
• -i date/offset — this option sets the start date for which keys or SKRs need to be generated (depending on the command). -i for *start*… don't ask, just vibe with it 💀
• -K directory — this option sets the directory in which the key files are to be read or written (depending on the command). 📁
• -k policy — this option sets the specific dnssec-policy for which keys need to be generated, or signed.
• -l file — this option provides a configuration file that contains a dnssec-policy statement (matching the policy set with -k). so -k and -l are a matched set, bestie, they're literally each other's other half 💜
• -o — normally when pregenerating keys, ZSKs are created. when this option is set, create KSKs instead. plot twist 🌪️
• -V — this option prints version information. the classic 🎀
• -v level — this option sets the debugging level. Level 1 is intended to be usefully verbose for general users; higher levels are intended for developers. so like, 1 is the "i'm a person" setting and above that is the "i write C for fun" setting 😭
• command — the KSR command to be executed. See below for the available commands 👇
• zone — the name of the zone for which the KSR command is being executed. 🌍

---

🔥 COMMANDS 🔥

• keygen — pregenerate a number of keys, given a DNSSEC policy and an interval. The number of generated keys depends on the interval and the key lifetime. ⭐
• request — create a Key Signing Request (KSR), given a DNSSEC policy and an interval. This will generate a file with a number of key bundles, where each bundle contains the currently published ZSKs (according to the timing metadata). 📦
• sign — sign a Key Signing Request (KSR), given a DNSSEC policy and an interval, creating a Signed Key Response (SKR). This will add the corresponding DNSKEY, CDS, and CDNSKEY records for the KSK that is being used for signing. ✍️👑

💖 EXIT STATUS 💖

The dnssec-ksr command exits 0 on success, or non-zero if an error occurred. slay when it's 0, cry when it isn't 😭

🦋 EXAMPLES 🦋

When you need to generate ZSKs for the zone "example.com" for the next year, given a dnssec-policy named "mypolicy":

dnssec-ksr -i now -e +1y -k mypolicy -l named.conf keygen example.com

Creating a KSR for the same zone and period can be done with:

dnssec-ksr -i now -e +1y -k mypolicy -l named.conf request example.com > ksr.txt

Typically you would now transfer the KSR to the system that has access to the KSK. like, go take it to the KSK's house 🏠✨

Signing the KSR created above can be done with:

dnssec-ksr -i now -e +1y -k kskpolicy -l named.conf -f ksr.txt sign example.com

⚠️ Make sure that the DNSSEC parameters in kskpolic — actually, kskpolicy — match those in mypolicy. fr fr, do not skip this check 🙈

🌈 SEE ALSO 🌈

dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual.

---

💫 Author 💫

Internet Systems Consortium 🫶

🍓 Copyright 🍓

2026, Internet Systems Consortium

---

and that's the whole page, bestie 💅 go forth and pregenerate those keys — this was BIND 9, version 9.20.30, dated 2026-10-12 ✨🎀🦋