DNSSEC-REVOKE(1)

💅 dnssec-revoke — like, the manual page, but make it make sense

Hey bestie, welcome to dnssec-revoke from BIND 9 — the little tool that puts the REVOKED bit on a DNSSEC key. Yes, that's literally the whole vibe. Let's go 🎀

---

✨ SYNOPSIS ✨

dnssec-revoke [-hr] [-v level] [-V] [-K directory] [-E engine] [-f] [-R]
{keyfile}

---

🌸 DESCRIPTION 🌸

Okay so picture this: dnssec-revoke reads a DNSSEC key file, sets the REVOKED bit on that key exactly as defined in [RFC 5011](https://datatracker.ietf.org/doc/html/rfc5011.html), and then births a brand-new pair of key files containing the now-revoked key. It's giving glow-up, but for keys 🦋

That's it. That's the job. And it ate. 💅

---

💖 OPTIONS 💖

• -h — prints a usage message and dips. Short and sweet, no notes. ✌️
• -K directory — tells it which directory the key files are supposed to live in. Like, pick a home for them.
• -r — says "yes, please remove the original keyset files after writing the new keyset files." Cleanup era 🧹
• -v level — sets the debugging level. Turn the volume up if you want to see more.
• -V — prints version information. Basic but necessary, iykyk.
• -E engine — specifies the cryptographic hardware to use, when applicable.

Real talk: when BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL engine identifier that drives the cryptographic accelerator or hardware service module — usually pkcs11. So like, keep that in mind 💀

• -f — forced overwrite mode 🔥 causes dnssec-revoke to write the new key pair even if a file already exists matching the algorithm and key ID of the revoked key. Bold. Iconic. Slightly chaotic.
• -R — prints the key tag of the key with the REVOKE bit set, but does not actually revoke the key. It's the "look, don't touch" option, bestie 🫶

---

🦋 SEE ALSO 🦋

• dnssec-keygen(8)
• BIND 9 Administrator Reference Manual
• [RFC 5011](https://datatracker.ietf.org/doc/html/rfc5011.html)

---

👑 Author 👑

Internet Systems Consortium

⭐ Copyright ⭐

2026, Internet Systems Consortium

---

okay that's the whole page, mwah 💋 This beautiful little manual ships with BIND 9, version 9.20.30, dated 2026-10-12 — screenshot it, cite it, frame it, whatever, just don't lose it 🌈✨