DNST-SIGNZONE(1)

💅 DNST-SIGNZONE(1) — the dnst girlies' guide

okay so listen bestie, this is dnst-signzone, part of the dnst tool family, and it's literally the glow-up station for your zone 🎀

---

✨ NAME ✨

dnst-signzone — sign the zone with whatever key(s) you're handing it 🔑

---

🌸 SYNOPSIS 🌸

dnst signzone [OPTIONS] -o <ORIGIN> <ZONEFILE> <KEY>...

---

🦋 DESCRIPTION 🦋

dnst signzone signs the zonefile using the key(s) you give it, no cap.

Signing a zone adds DNS Security Extensions (DNSSEC) resource records to it — that's the whole vibe ✨

Keys have to be specified by their base name (usually K<name>+<alg>+<id>), meaning WITHOUT the .private or .key extension. And heads up: you need both the .private and the .key files, both of them, periodt.

---

🎀 ARGUMENTS 🎀

• <ZONEFILE> — the zonefile you're signing. Any existing NSEC(3) and/or RRSIG resource records will be skipped when loading the file (so don't stress about duplicates, they get ignored 🙈).
• <KEY>... — the keys you're signing the zonefile with.

---

💅 OPTIONS 💅

• -d — don't add the used keys to the resulting zonefile.
• -e <DATE> — set the expiration date of signatures to this date (peep the DATES section 👀). Defaults to 4 weeks from now.
• -f <FILE> — write the signed zone to a file. Use -f - to output to stdout instead. Defaults to <ZONEFILE>.signed.
• -i <DATE> — set the inception date of signatures to this date (again, DATES section). Defaults to now.
• -o <DOMAIN> — use this owner name as the apex of the zone. Mandatory, so you literally cannot skip it.
• -u — set the SOA serial to the number of seconds since Jan 1st 1970.

If this would NOT result in the SOA serial increasing, it gets incremented instead. (no time-traveling serials allowed 💀)

• -n — use NSEC3 instead of NSEC. By default, RFC 9276 best practice settings are used: SHA-1, no extra iterations, empty salt. Want different NSEC3 settings? Check the NSEC3 options below.
• -A — sign DNSKEYs with all keys instead of the minimal set.
• -U — sign with every unique algorithm in the provided keys.
• -z <[SCHEME:]HASH> — add a ZONEMD resource record. Accepts both mnemonics and numbers. You can pass this option more than once to add multiple ZONEMD RRs — however, only one per scheme-hash tuple actually gets added. HASH supports SHA384 (1) and SHA512 (2). SCHEME supports SIMPLE (1), which is the default.
• -Z — allow adding ZONEMD RRs without signing the zone. With this option, the <KEY>... argument becomes optional, and it determines whether to sign the zone.
• -H — hash only, don't sign. With this option, the normally mandatory <KEY>... argument can be omitted 🫶
• -h, --help — print the help text (short summary with -h, long help with --help).

---

🌈 OUTPUT FORMATTING OPTIONS 🌈

These ones only affect how the output is formatted, bestie — the following options can be used for that:

• -b — add comments on DNSSEC records. Without this option, only DNSKEY RRs get their key tag annotated in the comment.
• -L — precede the zone output by a list containing the NSEC3 hashes of the original ownernames.
• -O — order NSEC3 RRs by unhashed owner name.
• -R — order RRSIG RRs by the record type that they cover.
• -T — output YYYYMMDDHHmmSS RRSIG timestamps instead of seconds since epoch.

---

🧚 NSEC3 OPTIONS 🧚

The following options can be used with -n to override the default NSEC3 settings:

• -s <STRING> — specify the salt as a hex string. Defaults to -, meaning empty salt.
• -t <NUMBER> — set the number of extra hash iterations. Defaults to 0.
• -p — set the opt-out flag on all NSEC3 RRs.
• -P — set the opt-out flag on all NSEC3 RRs and skip unsigned delegations.

---

⭐ DATES ⭐

A date can be a UNIX timestamp as seconds since the Epoch (1970-01-01 00:00 UTC), or of the form <YYYYMMdd[hhmmss]>. Easy ✨

---

👑 AUTHOR 👑

NLnet Labs

---

💖 COPYRIGHT 💖

2024–2026, NLnet Labs

---

okay that's the whole thing, mwah 💋 — this page is from the dnst manual, version 0.2.0-alpha2, dated May 15, 2026, brought to you by the lovely people at NLnet Labs. go sign your zone, it's giving secure 🌸🦋