KZONESIGN(1)

📦
version 3.6.2 · 16 versions
, in nixpkgs unstable, opensuse-leap 16.0

✨ KZONESIGN(1) ✨

okay so this is the man page for kzonesign, straight out of the Knot DNS fam 💅 — it's the DNSSEC signing utility and honestly it's kind of iconic.

🌸 NAME 🌸

kzonesign — the DNSSEC signing utility. that's it, that's the whole vibe. it signs zones and it does it well.

🦋 SYNOPSIS 🦋

kzonesign [config_option] [options] zone_name

like, config option, then options, then the zone name. order matters bestie, we love a structured queen 👑

💖 DESCRIPTION 💖

so here's the tea: this utility reads the zone's zone file, signs the zone according to whatever configuration you gave it, and then writes the signed zone file back. slay. 🎀

an alternative mode is DNSSEC validation of the given zone — so instead of signing, you're just checking that everything is correct. vibe check, but cryptographically.

and the glow-up? the signing or validation can run in parallel if it's enabled in the configuration (peep policy.signing-threads and zone.adjust-threads — those are the ones doing the heavy lifting 🏋️).

🫶 Parameters

  • zone_name — a name of the zone to be signed. literally just the zone, bestie.

🎀 Config options

  • -c, --config file — use a textual configuration file. the default is /etc/knot/knot.conf, iykyk.
  • -C, --confdb directory — use a binary configuration database directory. default is /var/lib/knot/confdb. also important: the default configuration database, if it exists, has a preference to the default configuration file. so if it's there, it wins 👑.

🌈 Options

  • -o, --outdir dir_name — write the output zone file to the specified directory instead of the configured one. lowkey useful when you want the output somewhere else entirely.
  • -r, --rollover — allow key roll-overs and NSEC3 re-salt. and listen: in order to finish possible KSK submission, set the KSK's active timestamp to now (+0) using keymgr. don't skip that part fr fr.
  • -v, --verify — instead of (re-)signing the zone, just verify that the zone is correctly signed. no signing, only judging 😌
  • -t, --time timestamp — sign/verify the zone (and roll the keys if necessary) as if it was at the time specified by timestamp. basically time travel but for DNSSEC 🕰️
  • -h, --help — print the program help. your bestie when you're lost.
  • -V, --version — print the program version. and the extra: the option -VV makes the program print the compile time configuration summary. yes, two V's, different behaviour, don't come for me 💀

🔥 EXIT VALUES 🔥

exit status of 0 means successful operation. any other exit status indicates an error. that's the whole rule. 0 = slay, anything else = something went wrong 😭

👑 SEE ALSO 👑

knot.conf(5), keymgr(8) — go read those too, they're the supporting cast and they ate.

💜 AUTHOR 💜

CZ.NIC, z.s.p.o. and contributors <https://www.knot-dns.cz/>

Copyright (C) CZ.NIC, z.s.p.o. and contributors

and that's the page, bestie 🧚 — this was version 3.6.2, dated 2026-10-21, brought to you by the Knot DNS girlies. go sign some zones. periodt. 💅✨

📦 where this page comes from