KEYMOD(1)

💖 keymod — bestie edition 💖

okay so like, this is keymod(1) from the User Contributed Perl Documentation section, and it's literally the glow-up tool for your DNSSEC-Tools keyrec files. no cap. let's get into it 🦋

---

✨ NAME ✨

keymod — Modifies key parameters in a DNSSEC-Tools keyrec file

---

✨ SYNOPSIS ✨

keymod [options] keyrec1 ... keyrecN

---

🌸 DESCRIPTION 🌸

so keymod changes the key parameters in a keyrec file — and those parameters are the ones used to generate cryptographic keys that sign zones. the new values get picked up by zonesigner when it's generating new keys. it does not touch keys that already exist, okay? those are grandfathered in, they're fine, leave them alone 💅

zonesigner will use the new parameter for a zone the next time it generates a key that requires that parameter. which means — and this is the part people get confused about, so listen — a new ZSK length won't be used during the next zonesigner run if that run is busy doing KSK-rollover actions. it's giving "patience is a virtue", fr fr 🙈

here's the list of fields you're allowed to modify:

kskcount - count of KSK keys
ksklength - length of KSK keys
ksklife - lifetime of KSK keys
random - random number generator device file
revperiod - revocation period for KSK keys
zskcount - count of ZSK keys
zsklength - length of ZSK keys
zsklife - lifetime of ZSK keys

when you change stuff, new key/value fields get added to the zone keyrec file so zonesigner knows new values should be used. and the key part of those added fields starts with new_. so for example, a new KSK length of 2048 gets written to the keyrec file as:

new_ksklength        2048

okay and now the scope situation: all zone records in the keyrec file you specified get modified — unless you pass the -zone option. in that case only the named zone gets modified. main character zone only, periodt 👑

and if a zone keyrec already has a new key/value field in it? then the value just gets modified on subsequent runs of keymod. it updates in place, it's very chill about it.

---

💅 OPTIONS 💅

keymod recognizes the following options. and yes, you can combine multiple options in a single keymod execution. go off.

all numeric values must be positive or zero. no negatives, bestie, that's not a vibe.

if you want a new key/value field to be deleted from a zone keyrec, then you specify a zero or empty string value for the appropriate option. poof, gone 🧚

• -zone zonename — The zone keyrec whose name matches zonename is selected as the only keyrec that will be modified. If this name is not given, then all zone keyrec records will be modified.
• -ksklength ksklength — The ksklength field will be modified in the selected keyrec records to the given value. This is a numeric field whose values depend on the cryptographic algorithm to be used to generate keys for the zone.
• -kskcount kskcount — The kskcount field will be modified in the selected keyrec records to the given value. This is a numeric field.
• -ksklife ksklife — The ksklife field will be modified in the selected keyrec records to the given value. This is a numeric field.
• -random random — The random field will be modified in the selected keyrec records to the given value. This is a text field that will be passed to the key generator.
• -revperiod revperiod — The revperiod field will be modified in the selected keyrec records to the given value. This is a numeric field.
• -zskcount zskcount — The zskcount field will be modified in the selected keyrec records to the given value. This is a numeric field.
• -zsklength zsklength — The zsklength field will be modified in the selected keyrec records to the given value. This is a numeric field whose values depend on the cryptographic algorithm to be used to generate keys for the zone.
• -zsklife zsklife — The zsklife field will be modified in the selected keyrec records to the given value. This is a numeric field.
• -nocheck — If this option is given, the krfcheck command will not be run on the modified keyrec file.
• -verbose — Display information about every modification made to the keyrec file.
• -Version — Displays the version information for keymod and the DNSSEC-Tools package.
• -help — Display a usage message.

---

🎀 COPYRIGHT 🎀

Copyright 2012-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details.

---

🌈 AUTHOR 🌈

Wayne Morrison, tewok@tislabs.com

---

⭐ SEE ALSO ⭐

• zonesigner(8), krfcheck(8)
• Net::DNS::SEC::Tools::keyrec.pm(3)
• file-keyrec(5)

---

and that's the whole page, bestie!! this was perl v5.42.0, dated 2025-07-23, and honestly? iconic. go modify those keyrecs responsibly 🫶💜