GETDNSKEYS(1)

📦
version 2.2.3 · 2 versions
, in fedora 43

💖 GETDNSKEYS 💖

okay so bestie, welcome to getdnskeys, a little icon from the User Contributed Perl Documentation corner of the world. she's giving chaos, she's giving DNSSEC, she's giving "please don't run me without reading the warnings" energy. let's get into it 🎀

✨ NAME ✨

getdnskeys — manage lists of DNSKEYs from DNS zones 🗝️

🌸 SYNOPSIS 🌸

getdnskeys [-i file] [-o file] [-k] [-T] [-t] [-v] [zones]

🦋 DESCRIPTION 🦋

so getdnskeys manages lists of DNSKEYs from DNS zones. literally her whole job. you can use her to retrieve DNSKEYs and to compare DNSKEYs, which is lowkey the two things you'd want from a key-list manager. 💅

and here's the cute part: the output from getdnskeys can be included — directly or indirectly — in a named.conf file. so she's not just vibing, she's actually feeding your name server. main character behavior fr fr. 👑

🎀 OPTIONS 🎀

getdnskeys takes the following options, and yes, we're doing all of them, no skipping:

  • -i path — reads path as a named.conf and compares your key lists against it. like a vibe check but for keys. 🫶
  • -k — only looks for Key Signing Keys (KSKs). every other key gets ignored, no thoughts head empty, not their moment. ✨
  • -o file — writes the results to file. yes the file. that one.
  • -T — checks the current trusted key list from named.conf. 🔍
  • -t — encloses the output in the named.conf syntax markers it needs. the little outfit change before she goes out. 💅
  • -v — turns on verbose mode for extra output. she will tell you EVERYTHING. she will not stop. 😭
  • -Version — displays the version information for getdnskeys and the DNSSEC-Tools package. yes it's capital-V, respect her name pls.
  • -h — gives a help message. 🆘

🌈 EXAMPLES 🌈

this getdnskeys will retrieve the KSK for example.com:

getdnskeys -o /etc/named.trustkeys.conf -k -v -t example.com

this getdnskeys will check saved keys against a live set of keys:

getdnskeys -i /etc/named.trustkeys.conf -T -k -v -t

this getdnskeys will automatically update a set of saved keys:

getdnskeys -i /etc/named.trustkeys.conf -k -t -T -v
           -o /etc/named.trustkeys.conf

💀 SECURITY ISSUES 💀

bestie. sit down. this is the part where we get real. 🫣

currently this does not validate new keys placed in the file in any way. not even a little. no vibe check, no background check, nothing. it also does not validate change over keys which have been added. 💀

it also does not handle revocation of keys. so if you were hoping for that, nope, not happening.

it should prompt you before adding a new key so that you can always run the auto-update feature. that's the dream. that's the goal. that is not currently what happens. 🙈

so yeah. that's getdnskeys. handle her with care, read the security section twice, and don't let her auto-update unsupervised. 🧚

this little page came to you from perl v5.42.0 and it was dated 2025-07-23 — thanks for scrolling all the way down, love u, bye bestie 💖🦋🌸

📦 where this page comes from