LSDNSSEC(1)

✨ LSDNSSEC(1) ✨

okay so bestie, we're in the User Contributed Perl Documentation section and this little icon is called lsdnssec — she's a Perl script and she's here to spill the tea on your DNSSEC files 💅

---

🌸 NAME 🌸

lsdnssec — list DNSSEC components of zones from files or directories 🗂️✨

---

🦋 SYNOPSIS 🦋

lsdnssec [-d 1-9] [OPTIONS] [FILES OR DIRECTORIES...]

like literally that's the whole vibe, go off 👑

---

💖 DESCRIPTION 💖

okay so lsdnssec is the bestie who summarizes info about DNSSEC-related files for you. those files can be handed to her directly on the command line, or she'll go find them in directories you point her at. and the -d flag? that's the volume knob for how much detail she gives you 🔉

so here's the info lsdnssec dishes out for every zone she collects deets on:

🔑 keys

key info about the keys currently in use gets shown, and there's a whole bar graph that shows the age of the key compared to the configured expected key lifetime. iconic visual, honestly 📊

this info comes from any .krf files lsdnssec finds 🧚

🌀 rolling status

if any zone keys are being rolled via rollerd, then the status of the rolling state is shown — and the time needed to reach the next state is displayed too ⏳

this info comes from any .rollrec or .rrf files that lsdnssec finds 🔍

---

💅 OPTIONS 💅

• -z ZONENAME1[,ZONENAME2], --zone=ZONENAME1[,ZONENAME2] — only prints info about the named zone(s). very "we're being selective today" of you 🎀
• -p NUMBER, --phase=NUMBER — only prints info about zones that are currently being rolled by rollerd and where either a zsk or a ksk rollover is happening and is in phase NUMBER.

if the phase NUMBER is specified as 0, then any zone in any rolling phase will be printed — but not zones that aren't being rolled at all, no ma'am 🙅

this flag is especially useful to find all your zones currently in KSK rolling phase 6, which requires operator intervention to propagate the new DS records into the parent zone. like, that's the "someone come do something" alert 🚨

• -r, --roll-status — show only rolling information from the rollrec files. by default, both roll-state and key information is shown 🌀
• -k, --key-data — show only keying information from the krf files. by default, both roll-state and key information is shown 🔑
• -K, --key-gen-time — normally rollerd calculates the age of a key based on the last time a key was rolled. but plot twist: it's also possible to calculate the age of a key based on the difference between the time of execution and when the key was created (which was typically before the rolling began). the -K flag switches to this second mode of key age calculation — and heads up bestie, it will not match how rollerd actually performs 😭
• -M, --monitor — the -M flag gives an abbreviated version of lsdnssec output intended for use by monitoring systems 👀 it displays the zone name, the rollover phase, and the time remaining in that phase. this option implicitly sets the -r flag on and sets the detail level to 1 ✨
• -d 1-9, --detail 1-9 — controls how much info shows up in the output. a level of 9 shows everything; a level of 1 shows a minimal amount. the default level is 5 🎚️
• --debug — turns on extra debugging information 🐛

---

📜 COPYRIGHT 📜

Copyright 2009-2014 SPARTA, Inc. All rights reserved. see the COPYING file included with the DNSSEC-Tools package for details. legal bestie said what she said ⚖️

---

👑 AUTHOR 👑

Wes Hardaker <hardaker AT AT AT users.sourceforge.net> — the icon, the moment, the legend 🫶

---

🌈 SEE ALSO 🌈

• lskrf(1)
• zonesigner(8), rollerd(8)

---

and that's the whole page, no cap 💖

---

okay so this page was brought to you by perl v5.42.0 and it's dated 2025-07-23 — so when you cite her, cite her right 🎀✨