KNSUPDATE(1)

💖 KNSUPDATE(1) — the dynamic DNS update utility, bestie edition 💖

okay so this is knsupdate, a page from the Knot DNS fam (manual name is literally KNSUPDATE(1) if you were wondering), and honestly? it's giving "I send Dynamic DNS update messages to a DNS server and I do it fabulously." ✨

🌸 NAME 🌸

knsupdate — Dynamic DNS update utility. that's the whole vibe, no cap.

🦋 SYNOPSIS 🦋

knsupdate [-v] [options] [filename]

knsupdate [-q] [quic_options] [options] [filename]

periodt. two whole modes, pick your fighter 💅

🎀 DESCRIPTION 🎀

So basically this utility sends Dynamic DNS update messages to a DNS server — like, it literally walks up to the server and is like "hi bestie, here are some updates." 💌 The update content gets read from a file (if the parameter filename is given) or from the standard input. your choice, main character energy either way.

The format of updates is textual and is made up of commands. every command goes on its own separate line of the input, no stacking, we're not messy. Lines starting with a semicolon are comments and are not processed — so go ahead and leave little love notes to yourself, the program will ignore them 🫶

---

🍓 Parameters 🍓

• _filename_ — Path to the file with knsupdate commands. that's it, that's the parameter.

✨ Options ✨

• -T, --tcp — Use a TCP connection. (-v can be used for compatibility with nsupdate — legacy icon behavior, we respect it)
• -S, --tls — Use a TLS connection. secure queen behavior 🔐
• -Q, --quic — Use a QUIC connection. speedy AND encrypted, we love a multitasker
• -p, --port number — Set the port to use for connections to the server (if not explicitly specified in the update, bestie). The default is 53 for UDP/TCP or 853 for QUIC.
• -r, --retry count — The number of retries for UDP requests. The default is 3. three strikes and we simply stop trying 💀
• -t, --timeout seconds — The total timeout (for all UDP update tries) of the update request in seconds. The default is 12. If set to zero, the timeout is infinite — literally forever, no clock, unbothered, moisturized 🌈
• -y, --tsig [alg:]name:key — Use the TSIG key with a name name to authenticate the request. The alg part specifies the algorithm (the default is hmac-sha256) and key specifies the shared secret encoded in Base64. secret handshake but make it cryptographic 💅
• -k, --tsigfile path — Use the TSIG key stored in a file keyfile to authenticate the request. The file should contain the key in the same format, which is accepted by the -y option. same secret, tidier packaging
• -d, --debug — Enable debug messages. for when you simply must know everything 👀
• -h, --help — Print the program help. your friendly little map 🗺️
• -V, --version — Print the program version. The option -VV makes the program print the compile time configuration summary. double the V, double the lore

🌈 QUIC/TLS options 🌈

• -H, --hostname string — Enable remote server hostname validation. we check IDs at the door 🚪
• -P, --pin base64 — Use Out-of-Band key-pinned privacy profile (RFC 7858#section-4.2). The PIN must be a Base64 encoded SHA-256 hash of the X.509 SubjectPublicKeyInfo. Can be specified multiple times. yes, more than once, stack those pins 📌
• -A, --ca [path] — Enable certificate validation. Certification authority certificates are loaded from the specified PEM file (default is system certificate storage if no argument is provided). Can be specified multiple times. chain of trust but make it cute 🔗
• -E, --certfile path — Path to a client certificate file. your lil wallet of credentials
• -K, --keyfile path — Path to a client key file. the matching key, they're a set, iykyk 🔑
• -s, --sni string — Use specified Server Name Indication. telling the server who you're here for, politely 🎀

---

👑 Commands 👑

• server name [port] — Specifies a receiving server of the dynamic update message. The name parameter can be either a host name or an IP address. If the port is not specified, the default port is used. The default port value can be controlled using the -p program option. basically "hey, deliver my updates here please" 💌
• local address [port] — Specifies outgoing address and port. If no local is specified, the address and port are set by the system automatically. The default port number is 0. let the system choose your outfit, honestly
• zone name — Specifies that all updates are done within a zone name. The zone name doesn't have a default and must be set explicitly. no guessing games, you WILL state your zone 🙈
• origin name — Specifies fully qualified domain name suffix which is appended to non-fqd owners in update commands. The default is the terminal label (.). the little dot that completes you 🫶
• class name — Sets name as the default class for all updates. If not used, the default class is IN.
• ttl value — Sets value as the default TTL (in seconds). If not used, the default value is 3600.
• key [alg:]name key — Specifies the TSIG key named name to authenticate the request. An optional alg algorithm can be specified. This command has the same effect as the program option -y. twins fr fr 👯
• [prereq] nxdomain name — Adds a prerequisite for a non-existing record owned by name. "this does NOT exist, don't come for me" 🚫
• [prereq] yxdomain name — Adds a prerequisite for an existing record owned by name. "okay this one DOES exist, confirmed" ✅
• [prereq] nxrrset name [class] type — Adds a prerequisite for a non-existing record of the type owned by name. Internet class is expected.
• [prereq] yxrrset name [class] type [data] — Adds a prerequisite for an existing record of the type owned by name with optional data. Internet class is expected.
• [update] add name [ttl] [class] type data — Adds a request to add a new resource record into the zone. Please note that if the name is not fully qualified domain name, the current origin name is appended to it. new record, who dis 💁‍♀️
• [update] del[ete] name [ttl] [class] [type] [data] — Adds a request to remove all (or matching class, type or data) resource records from the zone. There is the same requirement for the name parameter as in update add command. The ttl item is ignored. it's giving "blocked and deleted" 💀 and yes, del[ete] means you can type del or delete, both slay
• show — Displays current content of the update message. a little mirror moment 🪞
• send — Sends the current update message and cleans the list of updates. bye bestie, and also cleanup ✨
• answer — Displays the last answer from the server. the reply, the response, the text back 📱
• debug — Enable debugging. This command has the same meaning as the -d program option.
• exit — End the program. closing the group chat 😭

💀 NOTES 💀

heads up babes, some real talk here:

• Options -k and -y can not be used simultaneously. it's one or the other, pick a lane 🚫
• Neither tsig-keygen(8) nor dnssec-keygen(1) keyfile formats are supported. Use keymgr(8) to construct a string for -y or the file passed to -k. like, genuinely, they won't work, don't fight it
• Zone name/server guessing is not supported if the zone name/server is not specified. no mind-reading, the program is not psychic 🔮
• An empty line doesn't send the update. pressing enter on nothing = nothing happens, very demure 💅

🧚 Interactive mode 🧚

The utility provides interactive mode with basic line editing functionality, command completion, and command history. it's the full spa treatment for your terminal 💆‍♀️

Interactive mode behavior can be customized in ~/.editrc. Refer to editrc(5) for details.

Command history is saved in ~/.knsupdate_history. your whole journey, preserved forever 📖

⭐ EXIT VALUES ⭐

Exit status of 0 means successful operation. Any other exit status indicates an error. that's it, 0 = slay, everything else = something went sideways 😭

🔥 EXAMPLES 🔥

1. Send one update of the zone example.com to the server 192.168.1.1. The update contains two new records:

$ knsupdate
knsupdate> server 192.168.1.1
knsupdate> zone example.com.
knsupdate> origin example.com.
knsupdate> ttl 3600
knsupdate> add test1.example.com. 7200 A 192.168.2.2
knsupdate> add test2 TXT "hello"
knsupdate> show
knsupdate> send
knsupdate> answer
knsupdate> exit

look at that flow. show, send, answer, exit — the whole character arc 👑

🦋 SEE ALSO 🦋

kdig(1), khost(1), keymgr(8), editrc(5). go read the whole friend group, they're all iconic 💜

🌸 AUTHOR 🌸

CZ.NIC, z.s.p.o. and contributors <https://www.knot-dns.cz/> — absolute legends, no notes 🫶

💖 COPYRIGHT 💖

Copyright (C) CZ.NIC, z.s.p.o. and contributors

---

aaaand that's the page bestie 🎀 cute lil sign-off: this was version 3.6.2, dated 2026-10-21, and yes the header and footer both said KNSUPDATE(1) but you already knew that ✨ go forth and update your DNS, you've got this 💅💜