KEYARCH(1)

👑 KEYARCH(1) — the DNSSEC-Tools key archiving era 💅

okay bestie, so this is keyarch from the User Contributed Perl Documentation, and it's about to be your new fave little cleanup crew. it archives old KSK and ZSK keys and honestly? it's giving janitor but make it ✨iconic✨. let's get into it.

---

✨ NAME ✨

keyarch — the DNSSEC-Tools daemon that archives your old KSK and ZSK keys 🗂️💖

---

🦋 SYNOPSIS 🦋

keyarch [options] <keyrec_file | rollrec_file>

like, options first, then ONE file, and it's either a keyrec file or a rollrec file. pick your fighter. 🎀

---

💜 DESCRIPTION 💜

So keyarch archives old KSK and ZSK keys. and when do we call a key "old"? bestie, when it's revoked or obsolete. that's it, that's the vibe check. 🔥

• keys marked as either kskrev or zskrev are revoked
• keys marked as either kskobs or zskobs are obsolete

Archived keys get prefixed with the seconds-since-epoch, which is how we tell apart a zone's keys that happen to share the same five digit number. no cap, that prefix is doing the heavy lifting. 💅

Now, about that required file argument:

• if it's a keyrec file, then the expired keys listed in that file get archived.
• if it's a rollrec file, then the keyrec files of the zones in that file get checked for expired keys.

If you pass the -zone option, then only revoked and obsolete keys belonging to the specified zone get archived. narrowing the scope, love that for you. 🎯

The archive directory is either zone-specific (listed in the zone's keyrec record in the zone's keyrec file) or the default archive directory given in the DNSSEC-Tools configuration file. either way, it knows where to put the stuff. 🫶

Oh and the count of archived keys is literally the program's exit code. cute, right? Error exit codes are negative though, so if things go sideways, you'll know. 😭

---

🌸 OPTIONS 🌸

The following options are recognized, and yes we're listing all of them because we don't skip:

• -zone zone_file — Name of the zone whose KSKs will be archived. If this is not given, then all the zones defined in the rollrec file will be checked. 👑
• -kskonly — Only archive KSK keys. KSK girlies only, ZSKs can stay home. ✨
• -zskonly — Only archive ZSK keys. flip side of the coin, ZSK supremacy today. 💫
• -dtconfig config_file — Name of an alternate DNSSEC-Tools configuration file to be processed. If specified, this configuration file is used in place of the normal DNSSEC-Tools configuration file, not in addition to it. Also, it will be handled prior to keyrec files, rollrec files, and command-line options. so it goes first, and it fully replaces the default one — not a duo, it's a solo act. 🎤
• -quiet — No output will be given. shhh. 🤫
• -verbose — Verbose output will be given. tell me EVERYTHING. 🗣️
• -help — Display a usage message. when you're lost, ask for directions bestie. 🧭
• -Version — Displays the version information for keyarch and the DNSSEC-Tools package. the receipts, if you will. 📜

---

💀 EXIT VALUES 💀

• On success, keyarch's exit code is the number of keys archived. yes, the exit code is doing math. slay. 🔢
• keyarch has a 0 exit code if the help message is given. 🙌
• keyarch has a negative exit code if an error is encountered. not the vibe, but at least it's honest. 😭

---

🎀 COPYRIGHT 🎀

Copyright 2007-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details. 📄💖

---

🌈 AUTHOR 🌈

Wayne Morrison, tewok@tislabs.com — thank you for your service king 👑

---

👀 SEE ALSO 👀

• rollerd(8), zonesigner(8)
• Net::DNS::SEC::Tools::conf.pm(3), Net::DNS::SEC::Tools::dnssectools.pm(3), Net::DNS::SEC::Tools::defaults.pm(3), Net::DNS::SEC::Tools::keyrec.pm(3), Net::DNS::SEC::Tools::rollrec.pm(3)
• keyrec(5), rollrec(5)

---

and that's the whole page, bestie 🫶 this one's perl v5.42.0, dated 2025-07-23, so go archive those keys and be the main character of your DNS setup 💅✨ no cap, periodt.