DNST-KEYGEN(1)

💖 DNST-KEYGEN(1) 💖

okay so real talk — this is dnst-keygen, and it lives in the dnst manual suite. it's the little key-making gremlin of the family and honestly? iconic. let's get into it 🎀

✨ NAME ✨

dnst-keygen — generate a new key pair for a domain name 🔑

🌸 SYNOPSIS 🌸

dnst keygen [OPTIONS] -a <ALGORITHM> <DOMAIN NAME>

🦋 DESCRIPTION 🦋

dnst keygen makes a brand new key pair for whatever domain name you hand it. that's the whole vibe. ✨

and bestie, it doesn't just make the key — it leaves you a whole little gift bag of files:

• K<name>+<alg>+<tag>.key — the public key file, and inside it? a DNSKEY RR in zone file format 👑
• K<name>+<alg>+<tag>.private — the private key file, holding the private key data fields in BIND's Private-key-format 🔒
• K<name>+<alg>+<tag>.ds — the public key digest file, containing the DS RR in zone file format. heads up tho: this one only gets created for key signing keys, no ZSK crumbs here 💅

so what are those little placeholders, you ask? let me break it down for you, i gotchu:

• <name> is the fully-qualified owner name for the key — with a trailing dot, do not forget the dot, the dot is the moment 🫶
• <alg> is the algorithm number of the key, zero-padded to 3 digits
• <tag> is the 16-bit tag of the key, zero-padded to 5 digits

and once it's all done and dusted? it prints out K<name>+<alg>+<tag> to you. slay. that's your receipt 🧾

🎀 ARGUMENTS 🎀

• <DOMAIN NAME> — the owner name of the apex of the zone that the generated key is meant to sign. basically, "whose zone is this key for, bestie?" 🗺️

💅 OPTIONS 💅

• -a <NUMBER OR MNEMONIC> — use the given signing algorithm. this one is MANDATORY, no skipping, no "i'll do it later", it's required fr fr ⚠️

possible values are:

• list — (no number) list available algorithms 👀
• RSASHA256 — number 8 — RSA with SHA-256
• ECDSAP256SHA256 — number 13 — ECDSA P-256 with SHA-256
• ECDSAP384SHA384 — number 14 — ECDSA P-384 with SHA-384
• ED25519 — number 15 — ED25519
• ED448 — number 16 — ED448

• -k — generate a key signing key (KSK) instead of a zone signing key (ZSK). the KSK/ZSK pipeline is real 🔥
• -b <BITS> — the length of the key, and only for RSA keys, iykyk. defaults to 2048 📏
• -r <DEVICE> — the randomness source to use for generation. defaults to /dev/urandom 🎲
• -s — create symlinks .key and .private pointing at the generated keys. shortcuts are self care 💫
• -f — overwrite existing symlinks (this one's for use with -s, so bring a friend) 🔁
• -h, --help — print the help text. short summary with -h, and the long help with --help 📖

👑 AUTHOR 👑

NLnet Labs — the authors, the moment, the main characters 🫡

🌈 COPYRIGHT 🌈

2024–2026, NLnet Labs — all the rights, all the years, periodt 💜

---

okay that's the whole page, you ate that reading bestie 🍓 and real quick before you go — this lovely little manual is dnst version 0.2.0-alpha2, dated May 15, 2026, so like… keep that in mind. mwah 💋✨