KNSEC3HASH(1)

💅 KNSEC3HASH(1) — the Knot DNS girlie's guide to NSEC3 hashing ✨

okay so bestie, welcome to knsec3hash, a Knot DNS utility and honestly? it's giving "small but mighty." it's the simple utility that computes an NSEC3 hash, no cap. 🎀

---

✨ NAME ✨

knsec3hash — a simple utility to compute an NSEC3 hash. that's it. that's the whole vibe. 🦋

---

🌸 SYNOPSIS 🌸

here's how you can call her, three iconic ways:

knsec3hash salt algorithm iterations name

knsec3hash algorithm flags iterations salt name

knsec3hash [-h] [-V]

like, pick your lane, she supports all three. periodt. 💅

---

💖 DESCRIPTION 💖

this utility generates an NSEC3 hash for a given domain name and parameters of an NSEC3 hash. literally exactly what it says on the tin. 🔥

🧂 Parameters

• salt — specifies a binary salt encoded as a hexadecimal string. hex string only, she's specific like that.
• algorithm — specifies a hashing algorithm by number. currently, the only supported algorithm is SHA-1 (number 1). so yeah, it's 1 or nothing, iykyk.
• iterations — specifies the number of additional iterations of the hashing algorithm. gotta hash it again. and again. and again. 😭
• name — specifies the domain name to be hashed. the main character of this whole operation, honestly. 👑
• flags — specifies NSEC3 flags as an unsigned integer. unsigned, bestie, don't push it. 🫶

🎀 Options

• -h, --help — print the program help. your friendly lil "what do i do" button. 💜
• -V, --version — print the program version. and listen, the option -VV makes the program print the compile time configuration summary. yes, double V. extra V, extra lore. 🌈

---

⭐ EXIT VALUES ⭐

• exit status of 0 means successful operation. slay, we love a win. 💖
• any other exit status indicates an error. 💀 not the vibe.

---

🦋 EXAMPLES 🦋

here's her in her natural habitat, fr fr:

$ knsec3hash 1 0 10 c01dcafe knot-dns.cz
7PTVGE7QV67EM61ROS9238P5RAKR2DM7 (salt=c01dcafe, hash=1, iterations=10)

and the icon herself, with the salt set to the little dash:

$ knsec3hash - 1 0 net
A1RT98BS5QGC9NFI51S9HCI47ULJG6JH (salt=-, hash=1, iterations=0)

ate. no crumbs. 🔥

---

🌸 SEE ALSO 🌸

• RFC 5155 <https://datatracker.ietf.org/doc/html/rfc5155.html> — DNS Security (DNSSEC) Hashed Authenticated Denial of Existence. yes that's the real name, i didn't make it up, i couldn't make that up. 😭
• knotc(8), knotd(8). her siblings. go say hi. 🫶

---

👑 Author 👑

CZ.NIC, z.s.p.o. and contributors <https://www.knot-dns.cz/>

🎀 Copyright 🎀

Copyright (C) CZ.NIC, z.s.p.o. and contributors

---

💌 cute lil sign-off: this is version 3.6.0, dated 2026-09-08 — go forth and hash responsibly, bestie. mwah. 💋