KRFCHECK(1)

💖 krfcheck — like a vibe check but for your keyrec file 💖

okay bestie, listen up: this is the manual page for krfcheck(1), a little script from the User Contributed Perl Documentation section. she does one job and she does it flawlessly: she reads a keyrec file and roasts it (gently) for problems, potential problems, and inconsistencies. 🎀

---

✨ SYNOPSIS ✨

krfcheck [-zone | -set | -key] [-count] [-quiet]
         [-verbose] [-Version] [-help] keyrec-file

---

🌸 DESCRIPTION 🌸

This script checks a keyrec file for problems, potential problems, and inconsistencies. it's giving concerned bestie reading your texts energy, but for DNSSEC-Tools data. 🫶

💅 Recognized problems

• no zones defined — the keyrec file does not contain any zone keyrecs. like, zero. empty. ghost town. 👻
• no sets defined — the keyrec file does not contain any set keyrecs.
• no keys defined — the keyrec file does not contain any key keyrecs.
• unknown zone keyrecs — a set keyrec or a key keyrec references a non-existent zone keyrec. pointing at nothing fr fr.
• missing key from zone keyrec — a zone keyrec does not have both a KSK key and a ZSK key. it's missing half its personality.
• missing key from set keyrec — a key listed in a set keyrec does not have a key keyrec.
• expired zone keyrecs — a zone has expired. rip boo, it's over. 💀
• mislabeled key — a key is labeled as a KSK (or ZSK) and its owner zone has it labeled as the opposite. the key is having an identity crisis and nobody told it.
• invalid zone data values — a zone's keyrec data are checked to ensure that they are valid. the following conditions are checked: existence of the zone file, existence of the KSK file, existence of the KSK and ZSK directories, the end-time is greater than one day, and the seconds-count and date string match.
• invalid key data values — a key's keyrec data are checked to ensure that they are valid. the following conditions are checked: valid encryption algorithm, key length falls within algorithm's size range, random generator file exists, and the seconds-count and date string match.

🦋 Recognized potential problems

• imminent zone expiration — a zone will expire within one week. she's on the clock, bestie. ⏰
• odd zone-signing date — a zone's recorded signing date is later than the current system clock. time travel? in my keyrec file? it's more likely than you think.
• orphaned keys — a key keyrec is unreferenced by any set keyrec. no set, no friends, no group chat. 😭
• missing key directories — a zone keyrec's key directories (kskdirectory or zskdirectory) does not exist.

🌈 Recognized inconsistencies

• key-specific fields in a zone keyrec — a zone keyrec contains key-specific entries. to allow for site-specific extensibility, krfcheck does not check for undefined keyrec fields.
• zone-specific fields in a key keyrec — a key keyrec contains zone-specific entries. to allow for site-specific extensibility, krfcheck does not check for undefined keyrec fields.
• mismatched zone timestamp — a zone's seconds-count timestamp does not match its textual timestamp.
• mismatched set timestamp — a set's seconds-count timestamp does not match its textual timestamp.
• mismatched key timestamp — a key's seconds-count timestamp does not match its textual timestamp.

---

👑 OPTIONS 👑

• -zone — only perform checks of zone keyrecs. this option may not be combined with the -set or -key options. pick a lane, queen. 💅
• -set — only perform checks of set keyrecs. this option may not be combined with the -zone or -key options.
• -key — only perform checks of key keyrecs. this option may not be combined with the -set or -zone options.
• -count — display a final count of errors. receipts, basically. 🧾
• -quiet — do not display messages. this option supersedes the setting of the -verbose option. she said 🤫 and meant it.
• -verbose — display many messages. this option is subordinate to the -quiet option. yapper mode, but -quiet always wins the argument.
• -Version — displays the version information for krfcheck and the DNSSEC-Tools package.
• -help — display a usage message.

---

💜 COPYRIGHT 💜

Copyright 2004-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details.

---

🎀 AUTHOR 🎀

Wayne Morrison, tewok@tislabs.com

---

⭐ SEE ALSO ⭐

cleankrf(8), fixkrf(8), lskrf(1), zonesigner(8)

Net::DNS::SEC::Tools::keyrec.pm(3)

file-keyrec(5)

---

bestie this page is from perl v5.42.0 and it was dated 2025-07-23 — go forth and check those keyrecs, you absolute icon 💖✨🦋 no cap, you're gonna slay.