ldns-signzone(1)

💖 ldns-signzone — the DNSSEC glow-up machine 💖

okay bestie, so this is the manual page for ldns-signzone(1), a General Commands Manual situation. yes it's a whole program, yes it signs zones, and yes we're gonna read it together like it's a group chat. grab a strawberry 🍓 and let's go.

---

✨ NAME ✨

ldns-signzone — sign a zonefile with DNSSEC data. that's it, that's the vibe. it takes your little zone and gives it the DNSSEC treatment. 💅

---

🌸 SYNOPSIS 🌸

ldns-signzone [ OPTIONS ] ZONEFILE KEY [KEY [KEY] ...  ]

like. options, then the zonefile, then as many keys as your heart desires. slay.

---

🦋 DESCRIPTION 🦋

ldns-signzone is the tool you use to generate a DNSSEC signed zone. when you run it, it makes you a brand new zonefile that's got RRSIG and NSEC(3) resource records all up in it, exactly as specified in RFC 4033, RFC 4034 and RFC 4035. no cap.

keys have to be specified by their base name — meaning without the .private part, okay? don't come in here typing the whole filename, that's not the move. so if the DNSKEY that belongs to the key in the .private file isn't already present in the zone, it gets read from the file <base name>.key. and if that file doesn't exist either? then the DNSKEY value gets generated from the private key. it literally just makes one for you. iconic behaviour fr fr.

you can specify multiple keys too, go off. Key Signing Keys are used as such when they're either already present in the zone, or they're specified in a .key file, and they have the SEP bit set. that's the whole rule, iykyk.

---

👑 OPTIONS 👑

• -b — augments the zone and the RR's with extra comment texts so the layout is way more readable and easier to debug. DS records get a bubblebabble version of the data in the comment text, and NSEC3 records get the unhashed owner names in the comment text. cute and useful. and heads up: without this option, only DNSKEY RR's get their Key Tag annotated in the comment text. that's the default, bestie.
• -d — do not add DNSKEY resource records for used keys to the signed zone. like, we're not doing that today.
• -e date — set the expiration date of the signatures to this date. the format can be YYYYMMDD[hhmmss], or a timestamp. both are fine, pick your fighter.
• -f file — use this file to store the signed zone in. default is <originalfile>.signed. yes the default is literally your file's name with .signed glued on the end. 🎀
• -i date — set the inception date of the signatures to this date. format can be YYYYMMDD[hhmmss], or a timestamp. same energy as -e but for when the sig starts living.
• -o origin — use this as the origin of the zone.
• -u — set the SOA serial to the number of seconds since 1-1-1970. that's a Unix timestamp serial, and honestly? iconic.
• -v — print the version and exit. that's all, bye 👋
• -z [scheme:]hash — calculate the zone's digest and add those as ZONEMD RRs. the (optional) scheme must be simple (or 1), and hash should be sha384 (or 1) or sha512 (or 2). this option can be given more than once, so stack them if you want. 🔥
• -Z — allow ZONEMDs to be added without signing. no signature, just the digest. wild but okay.
• -A — sign the DNSKEY record with all keys. by default it's signed with a minimal number of keys, to keep the response size for the DNSKEY query small, and only the SEP keys that are passed are used. if there are no SEP keys, the DNSKEY RRset is signed with the non-SEP keys. this option turns off the default and all keys are used to sign the DNSKEY RRset. it's giving "go big or go home".
• -U — sign with every unique algorithm in the provided keys. the DNSKEY set is signed with all the SEP keys, plus all the non-SEP keys that have an algorithm that was not present in the SEP key set. algorithm diversity queen. 🌈
• -E name — use the EVP cryptographic engine with the given name for signing. this can have some extra options; see ENGINE OPTIONS below for more info, bestie.
• -K algorithm-id,key-id — use the key key-id as the signing key for algorithm algorithm-id as a Key Signing Key (KSK). this option is used when you use an OpenSSL engine, see ENGINE OPTIONS for more information.
• -k algorithm-id,key-id — use the key key-id as the signing key for algorithm algorithm-id as a Zone Signing Key (ZSK). this option is also used when you use an OpenSSL engine, see ENGINE OPTIONS for more information. (yes -K is the KSK one and -k is the ZSK one, case matters, do not mix them up 😭)
• -n — use NSEC3 instead of NSEC. choosing violence, choosing hashing.

---

🧚 if you use NSEC3, you can specify the following extra options 🧚

• -a algorithm — algorithm used to create the hashed NSEC3 owner names.
• -p — Opt-out. all NSEC3 records in the zone will have the Opt-out flag set. after signing, you can add insecure delegations to the signed zone. very much a "we'll deal with it later" move, but a legit one.
• -s string — Salt. season your hashes, bestie. 🧂
• -t number — Number of hash iterations. it's the number, that's the whole thing.

---

💜 ENGINE OPTIONS 💜

you can modify the possible engines, if supported, by setting an OpenSSL configuration file. this is done through the environment variable OPENSSL_CONF. 👑

the key options (-k and -K) work as follows: you specify a DNSSEC algorithm — using its symbolic name, for instance, RSASHA256, or its numeric identifier, for instance, 8 — followed by a comma and a key identifier. and listen: white space is not allowed between the algorithm and the comma, and between the comma and the key identifier. do not put a space there. i'm serious. the parser will simply not have it. 💀

the key identifier can be any of the following:

<id>
<slot>:<id>
id_<id>
slot_<slot>-id_<id>
label_<label>
slot_<slot>-label_<label>

where <id> is the PKCS #11 key identifier in hexadecimal notation, <label> is the PKCS #11 human-readable label, and <slot> is the slot number where the token is present. got it? got it. 📝

more recent versions of OpenSSL engines may support the PKCS #11 URI scheme (RFC 7512), so please consult your engine's documentation for that one — that's above my pay grade and also above this manpage's.

and if it's not already present, a DNSKEY RR is generated from the key data, and added to the zone. it just does that. 🫶

---

⭐ EXAMPLES ⭐

ldns-signzone nlnetlabs.nl Knlnetlabs.nl.+005+12273

sign the zone in the file nlnetlabs.nl with the key in the files Knlnetlabs.nl.+005+12273.private. if the DNSKEY is not present in the zone, use the key in the file Knlnetlabs.nl.+005+12273.key. and if that is not present either, generate one with default values from Knlnetlabs.nl.+005+12273.private. three-tier fallback, the pipeline of all time. 🔥

---

🌸 AUTHORS 🌸

written by the ldns team as an example for ldns usage.

portions of engine support by Vadim Penzin <vadim@penzin.net>. thank you for your service 🫡

---

🚨 REPORTING BUGS 🚨

report bugs to <dns-team@nlnetlabs.nl>. if something's broken, tell the team, don't suffer in silence bestie.

---

🎀 COPYRIGHT 🎀

Copyright (C) 2005-2008 NLnet Labs. this is free software. there is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

okay real talk: no warranty means no warranty. if it breaks, that's on you, not on them. read that twice, bestie. 😭

---

and that's the whole page! this was the ldns-signzone(1) manpage from 13 March 2018, brought to you by the General Commands Manual girlies. go sign your zone, secure your DNS, and remember: your RRSIGs are valid, your keys are SEP-bit blessed, and you are the main character. periodt. 💖✨🦋