GETDS(1)

📦
version 2.2.3 · 2 versions
, in fedora 43

💖 GETDS(1) — the getds era 💖

okay so bestie, welcome to the manual page for getds, a lil gem from the User Contributed Perl Documentation corner of the world. It's giving "make me a DS record, slay" and honestly? We're obsessed. Let's get into it. 🎀

✨ NAME ✨

getds — create a DS record from DNSKEYing information 🌸

✨ SYNOPSIS ✨

getds <domain>

✨ DESCRIPTION ✨

So here's the vibe: getds will create a DS record from DNSKEYs for the DNS domain you specify. It does this by converting DNSKEYs to DS records using the hashing algorithm you pick. Then you can take those results and pass them along to upstream DNSSEC-supporting parents or to DLV registries. Periodt. 💅

But wait, there's more (there's always more, iykyk). getds will also pull the parent's published DS records and compare them against the existing keys. Then it lists:

  • any DS records that are not published in the parent, and
  • any DS records that are published in the parent but which don't match an existing key.

So it's basically a vibe check for your DS records. 🔥

✨ OPTIONS ✨

getds takes the following options:

  • -a ALGORITHMS, --hash-algorithm algorithm ALGORITHMS — this one specifies the hash algorithm to use when converting DNSKEYs to DS records. You can pass a comma-separated list if you want multiple algorithms, because why choose? The algorithms to choose from may be either SHA256 or SHA1. 🌈

The default is SHA256,SHA1

  • -f KEYFILE, --read-key-file KEYFILE — this one specifies a file with a DNSKEY stored in it (such as created by bind's dnssec-keygen program). Super helpful for comparing a known good key file against something that's actually published. 🦋
  • -z, --print-zsks — this one causes getds to print ZSK DS records, as well as KSK records. Not me giving you the full lineup. 👑
  • -p, --dont-check-parent — instructs getds to not check the records in the parent for their published DS records. Sometimes you just don't wanna look, and that's valid. 🙈
  • -q, --quiet — produces quiet output with no explanatory headers. In other words, it only prints the DS records generated from the DNSKEYs. Minimalist queen behavior. 🤫
Note: Running with -q implies -p. (The quiet girlies don't check parents, no cap.) 💀

🔒 SECURITY CONSIDERATIONS 🔒

By default, getds pulls data from the live DNS. If your DNS resolver isn't configured so that this is pulled securely, then the results can't be trusted. Like, at all. Do not trust. Trust issues fr fr. 😭

Copyright 2008-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details. 💜

👑 AUTHOR 👑

Wes Hardaker, hardaker AT AT AT users.sourceforge.net 🫶

And that's the whole page, bestie — no notes, it ate. This was perl v5.42.0, dated 2025-07-23, and honestly? Main character energy from start to finish. Go make some DS records. 💖✨🎀🦋🌸💅

📦 where this page comes from