DTINITCONF(1)

📦
version 2.2.3 · 2 versions
, in fedora 43

💖 DTINITCONF 💖

okay so bestie, this is the dtinitconf page from the User Contributed Perl Documentation section of the manual — it's a Perl script that sets up your DNSSEC-Tools config file and honestly? it's giving "let me handle the boring part for you" energy. periodt. 🎀

✨ NAME ✨

dtinitconf — creates a DNSSEC-Tools configuration file 🌸

🦋 SYNOPSIS 🦋

dtinitconf [options]

👑 DESCRIPTION 👑

So here's the whole vibe. The dtinitconf program initializes the DNSSEC-Tools configuration file. By default, it's gonna create the actual configuration file, but like, you can totally tell it which file you want instead — the created file is specifiable by the user. 💅

IMPORTANT bestie: existing files — whether it's the default one or one you specified yourself — will not be overwritten unless you specifically direct the program to do it. no accidental yeeting of your config. we respect boundaries here. 🫶

Every single configuration field can be individually specified right there on the command line. iconic. ✨ And you'll also get prompted for the fields, with the default values pulled straight from the DNSSEC-Tools defaults.pm module. If you pass the -noprompt option, then a default configuration file gets created instead (modulo whatever command-line arguments you gave it) — no questions asked, just vibes. 😌

Now, configuration entries get created for several BIND programs, and finding those programs is a whole little scavenger hunt:

  1. First, the directories in the path environment variable get checked — and the names of any directories that contain the BIND programs get saved. 📌
  2. Next, several common locations for BIND programs get checked — and again, the names of directories containing the BIND programs get saved. 📌
  3. After collecting all those directories, you get presented with the list and you can choose whichever set you want. main character decision-making moment, honestly. 👑
  4. If no directories are found that contain the BIND programs, then you get prompted for the proper location. ngl, at that point it's on you bestie. 🙈

One more thing, and it's lowkey important: if the configuration file's parent directory doesn't exist, then an attempt is made to create the directory. 🛠️ The new directory's ownership gets set to root for the owner and dnssec for the group — assuming the dnssec group actually exists, iykyk.

heads up: writability checks for the directory will not be performed if the -outfile option is given. so like, don't come crying to me about permissions, okay? 💀

✨ OPTIONS ✨

dtinitconf has options that control what goes into the shiny new DNSSEC-Tools configuration file it's about to generate. Every single entry in that config file has a matching command-line option, bestie — it's a whole matching set. They're listed below in cute little logical groups, same as always. 🎀

These ones are all about making and managing encryption keys.

  • -algorithm algorithm — Picks the crypto algorithm. Whatever you put for algorithm has to be something the version of dnssec-keygen you've got installed actually recognizes.
  • -kskcount KSK-count — The default number of KSK keys that get created for a zone.
  • -ksklength keylen — The default KSK key length that gets passed along to dnssec-keygen.
  • -ksklife lifespan — The default amount of time between KSK rollovers, measured in seconds. This has to fall inside the range between the minlife and maxlife values.
Heads up: this value is only used for key rollover. Keys do not have a life-time in any other sense. Like, none. Don't make it a thing. 🙈
  • -maxlife maxlifespan — The maximum amount of time between key rollovers, in seconds. The ksklife and zsklife values must not be greater than this.
Same deal: only used for key rollover. Keys do not have a life-time in any other sense. 💀
  • -minlife minlifespan — The minimum amount of time between key rollovers, in seconds. The ksklife and zsklife values must not be less than this.
And again: only used for key rollover. Keys do not have a life-time in any other sense. periodt.
  • -zskcount ZSK-count — The default number of ZSK keys that get created for a zone.
  • -zsklength keylen — The default ZSK key length that gets passed along to dnssec-keygen.
  • -zsklife lifespan — The default amount of time between ZSK rollovers, in seconds. This has to be within the minlife to maxlife range.
Yes bestie, one more time: only for key rollover. Keys do not have a life-time in any other sense. 🌸
  • -random randomdev — The random device generator that gets passed to dnssec-keygen.

These are about zone signing and all its business.

  • -endtime endtime — The zone's default expiration time, passed along to dnssec-signzone.

These deal with running trustman and its various little tasks.

  • -genroothints roothints — A brand new root.hints file gets created at the location you specify. dtinitconf requires that the file does not already exist, so don't come in with leftovers.

The root.hints file is fetched from http://www.internic.net/zones/named.root. If dtinitconf can't grab the file, that is not considered a fatal error — instead you get a warning message and the creation of the configuration file just keeps on going. resilient queen. 💅

  • -ta-contact email — The email address of the trustman administrator.
  • -ta-resolvconf resolvconffile — Where the resolv.conf file lives.
  • -ta-smtpserver hostname — The SMTP server for the trustman command.
  • -ta-tmpdir hostname — The temporary directory for the trustman command.

🦋 BIND Options

These are specifically about functionality that BIND itself provides.

  • -rndc rndc-path — rndc is the path to BIND's rndc command.

👑 DNSSEC-Tools Options

These deal specifically with stuff DNSSEC-Tools provides.

  • -admin email-address — admin is the email address of the DNSSEC-Tools administrator. This is the default address used by the dt_adminmail() routine.
  • -archivedir directory — directory is the archived-key directory. Old encryption keys get moved here, but only if they're meant to be saved and not deleted.
  • -autosign — A flag saying rollerd should automatically sign zonefiles it finds to be newer than their signed zonefile. If -noautosign is given, this gets set to false.
  • -binddir directory — directory is where the BIND programs live. If you pass the reserved word "path", then the existence of the BIND programs is not verified when dtinitconf runs — instead, the user's PATH directories get searched for the BIND programs whenever the DNSSEC-Tools are executed. no cap.
  • -dtdir directory — directory is where the DNSSEC-Tools programs live. If you pass the reserved word "path", then the existence of the DNSSEC-Tools programs is not verified when dtinitconf runs — instead, the user's PATH directories get searched for the DNSSEC-Tools programs when those tools get executed. ✨
  • -entropy_msg — A flag saying zonesigner should display a message about entropy generation. This mainly depends on how a system's random number generation is implemented.
  • -mailer-server host — The mail server that dt_adminmail() will contact. This gets passed to Mail::Send.
  • -mailer-server mailtype — The mail type that dt_adminmail() will contact. This gets passed to Mail::Mailer (by way of Mail::Send). Any values Mail::Mailer recognizes are fair game here.
  • -noentropy_msg — A flag saying zonesigner should not display a message about entropy generation. Again, this mainly depends on the system's random number generation implementation.
  • -roll-loadzone, -no-roll-loadzone — Flags saying whether or not rollerd should have the DNS daemon load zones.
  • -roll-logfile logfile — logfile is the logfile for the rollerd daemon.
  • -roll-loglevel loglevel — loglevel is the logging level for the rollerd daemon.
  • -roll-phasemsg length — length is the default length of phase-related log messages used by rollerd. The valid levels are "long" and "short", and "long" is the default.

The long message length means a phase description gets included with some log messages. Example: the long form of a message about ZSK rollover phase 3 looks like "ZSK phase 3 (Waiting for old zone data to expire from caches)".

The short message length means a phase description is not included with some log messages. Example: the short form of a message about ZSK rollover phase 3 looks like "ZSK phase 3".

  • -roll-sleeptime sleep-time — sleep-time is the sleep-time for the rollerd daemon.
  • -roll-username username — username is the user that the rollerd daemon will be executed as. If this is a username, it must correspond to a valid uid; if it's a uid, it must correspond to a valid username. mutual, bestie. 🫶
  • -roll-logtz logtz — loglevel is the timezone of the message timestamp for rollerd's logfile. (yes, it says loglevel there, that's literally what the page says, iykyk 🙈)
  • -zoneerrs error-count — error-count is the maximum error count for zones used by the rollerd daemon.
  • -savekeys — A flag saying old keys should be moved to the archive directory.
  • -nosavekeys — A flag saying old keys should not be moved to the archive directory, and instead just get left in place.
  • -usegui — A flag saying the GUI for specifying command options may be used.
  • -nousegui — A flag saying the GUI for specifying command options should not be used.
  • -zoneparser parser-module — parser-module is the name of the Perl module that'll be used to parse zone files. The default is specified in dnssec_tools_default().

💜 dtinitconf Options

And these are the ones that are all about dtinitconf itself.

  • -outfile conffile — The configuration file gets written to conffile. If you don't give this, then the default configuration file (whatever Net::DNS::SEC::Tools::conf::getconffile() returns) is used.

If conffile is given as -, then the new configuration file gets written to standard output. slay.

conffile must be writable.

  • -overwrite — If -overwrite is specified, existing output files may be overwritten. Without -overwrite, if the output file already exists then dtinitconf gives you an error message and exits. no sneaky overwrites around here.
  • -noprompt — If -noprompt is specified, you will not be prompted for any input at all. The configuration file gets created from the command-line options plus DNSSEC-Tools defaults, and guesses get made for the BIND paths based on the PATH environment variable.
WARNING: After using the -noprompt option, the configuration file must be checked to make sure the defaults are appropriate and acceptable for the installation. Do not skip this, fr fr. 😭
  • -template — If -template is specified, a default configuration file is created — except every single entry is commented out.

The only command line options you may use alongside -template are -outfile and -overwrite. That's it, that's the list.

  • -edit — If -edit is specified, the output file gets edited after it's been created. The EDITOR environment variable is consulted for which editor to use. If the EDITOR environment variable isn't defined, then the vi editor gets used.
  • -verbose — Provide verbose output.
  • -Version — Displays the version information for dtinitconf and the DNSSEC-Tools package.
  • -help — Display a usage message and exit.

Copyright 2006-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details.

✍️ AUTHOR

Wayne Morrison, tewok@tislabs.com

🌈 SEE ALSO

dnssec-keygen(8), dnssec-signzone(8), named-checkzone(8), keyarch(8), rollckk(8), rollerd(8), zonesigner(8)

Net::DNS::SEC::Tools::conf.pm(3), Net::DNS::SEC::Tools::defaults.pm(3), Net::DNS::SEC::Tools::dnssectools.pm(3), Net::DNS::SEC::Tools::tooloptions.pm(3), QWizard.pm(3)

dnssec-tools.conf(5)

and that's the whole page bestie!! 🎀 this one's perl v5.42.0, dated 2025-07-23, and it's page DTINITCONF(1) — go forth and configure, you absolute icon 💅✨👑

📦 where this page comes from