PDNSUTIL(1)

📦
version 5.0.7 · 12 versions
, in alpine 3.24, epel 10, epel 9, fedora 43, fedora 44

👑 pdnsutil — PowerDNS Authoritative Server 💅

okay bestie, welcome to pdnsutil(1) from the PowerDNS Authoritative Server era. this is the group chat you wanna be in.

✨ NAME ✨

pdnsutil — PowerDNS record and DNSSEC command and control. she does records, she does DNSSEC, she does zone management, she does it all. periodt.

🌸 SYNOPSIS 🌸

pdnsutil [OPTION]... COMMAND

that's it. options, then a command. iconic structure honestly.

🦋 DESCRIPTION 🦋

so pdnsutil (and yes, she used to go by pdnssec, she rebranded, we love a glow-up 💅) is a powerful command that is literally your operator-friendly gateway into DNSSEC and zone management for PowerDNS.

behind the scenes, pdnsutil manipulates a PowerDNS backend database. and the way that matters is: for many databases, you can run pdnsutil remotely, and you can configure key material on different servers. like, she's not picky about location. she's flexible like that. ✨

💖 OPTIONS 💖

  • -h, --help — show summary of options. when you're lost, she's there. 🫶
  • -v, --verbose — be more verbose. more words, more info, more everything.
  • -f, --force — force an action. she will do the thing even if the thing is being stubborn.
  • -q, --quiet — be quiet. shhh. 🤫
  • --config-name <NAME> — virtual configuration name.
  • --config-dir <DIR> — location of pdns.conf. default is /etc/powerdns.

🌈 COMMANDS 🌈

there are many available commands, and most of them follow this pattern:

pdnsutil <object> <action> [arguments...]

where <object> is a noun and <action> is a verb. it's giving grammar lesson but make it DNS. 🎀

a few commands which do not apply to any particular object kind use only the verb. those ones are the independent main characters. 👑

🌟 AUTOPRIMARY COMMANDS 🌟

  • autoprimary add IP NAMESERVER [ACCOUNT] — add a autoprimary entry into the backend. this enables receiving zone updates from other servers. you're letting other servers slide into your zone updates. 🙈
  • autoprimary list — list all autoprimaries. the whole roster. 📋
  • autoprimary remove IP NAMESERVER — remove an autoprimary from backend. not supported by BIND backend. so if you're on BIND, this one's not for you bestie, sorry. 💀

🎀 CATALOG ZONE COMMANDS 🎀

  • catalog list-members CATALOG — list all members of catalog zone CATALOG" (yes, that quote is in the original, she's got a little typo and we're keeping her exactly as she is, no notes 💖)
  • catalog set ZONE [CATALOG] — change the catalog of ZONE to CATALOG. if CATALOG is omitted, removes ZONE from the catalog it is in. so you can either move her or yeet her, your call. ✨

💜 ZONE METADATA COMMANDS 💜

  • metadata add ZONE KIND VALUE [VALUE]... — append VALUE to the existing KIND metadata for ZONE. will return an error if KIND does not support multiple values, use metadata set for these values. she said one value only and she meant it. 😭
  • metadata get ZONE [KIND]... — get zone metadata. if no KIND given, lists all known.
  • metadata set ZONE KIND [VALUE]... — set zone metadata KIND for ZONE to VALUE, replacing all existing values of KIND. an omitted value clears it. out with the old, in with the new. 🔥

🧚 NETWORK COMMANDS 🧚

  • network list — list all defined networks with their chosen views.
  • network set NET [VIEW] — set the VIEW for a the NET network, or delete if no VIEW argument. (again, "a the" is the original's wording, we are not editing her, she's perfect as she is 🫶)

🍓 ZONE RECORD COMMANDS 🍓

in these commands, the rrset object name may also be written as record. so either one, same energy. 💅

  • rrset add ZONE NAME TYPE [TTL] CONTENT — add one or more records of NAME and TYPE to ZONE with CONTENT and optional TTL. if TTL is not set, the configured default-ttl will be used. NAME must be absolute.
  • rrset delete ZONE NAME TYPE — delete named RRSET from zone. NAME must be absolute.
  • rrset hash ZONE RNAME — this convenience command hashes the name RNAME according to the NSEC3 settings of ZONE. refuses to hash for zones with no NSEC3 settings. she will simply not do it. not her problem. 🙅♀️
  • rrset replace ZONE NAME TYPE [TTL] CONTENT [CONTENT...] — replace existing NAME in zone ZONE with a new set.

these commands manipulate TSIG key information in the database. some commands require an ALGORITHM, which can be any of the following:

  • hmac-md5
  • hmac-sha1
  • hmac-sha224
  • hmac-sha256
  • hmac-sha384
  • hmac-sha512

pick your fighter. 🥊

  • tsigkey activate ZONE NAME {primary,secondary,producer,consumer} — enable TSIG authenticated AXFR using the key NAME for zone ZONE. this sets the TSIG-ALLOW-AXFR (primary/producer) or AXFR-MASTER-TSIG (secondary/consumer) zone metadata.
  • tsigkey deactivate ZONE NAME {primary,secondary,producer,consumer} — disable TSIG authenticated AXFR using the key NAME for zone ZONE.
  • tsigkey delete NAME — delete the TSIG key NAME.
⚠️ Warning: this does not deactivate said key. like, she'll delete the key but she will NOT clean up after it. that's on you bestie. 😭
  • tsigkey generate NAME ALGORITHM — generate new TSIG key with name NAME and the specified algorithm.
  • tsigkey import NAME ALGORITHM KEY — import KEY of the specified algorithm as NAME.
  • tsigkey list — show a list of all configured TSIG keys.

🦋 VIEWS COMMANDS 🦋

  • views add-zone VIEW ZONE..VARIANT — add the given ZONE VARIANT to a VIEW.
  • views del-zone VIEW ZONE..VARIANT — remove a ZONE VARIANT from a VIEW.
  • views list VIEW — list all zones within VIEW.
  • views list-all — list all view names.

🌸 ZONE MANIPULATION COMMANDS 🌸

  • zone check ZONE — check zone ZONE for correctness. vibe check, but for your zone. ✅
  • zone check-all [exit-on-error] — check all zones for correctness, aborting upon finding the first error in any zone if "exit-on-error" is specified. she's thorough but she will absolutely stop at the first mess if you tell her to.
  • zone clear ZONE — clear the records in zone ZONE, but leave actual zone and settings unchanged. records gone, settings stay. the outfit changes, the girl does not. 💅
  • zone create ZONE — create an empty zone named ZONE.
  • zone delete ZONE — delete the zone named ZONE.
  • zone edit ZONE — opens ZONE in zonefile format (regardless of backend it was loaded from) in the editor set in the environment variable EDITOR. if EDITOR is empty, pdnsutil falls back to using editor.
  • zone increase-serial ZONE — increases the SOA-serial by 1. uses SOA-EDIT.
  • zone list ZONE — show all records for ZONE.
  • zone list-all KIND — list all active zone names of the given KIND (primary, secondary, native, producer, consumer), or all if none given. passing --verbose or -v will also include disabled or empty zones.
  • zone load ZONE FILE — load records for ZONE from FILE. if ZONE already exists, all records are overwritten, this operation is atomic. if ZONE doesn't exist, it is created. either way, she handles it. ✨
  • zone set-account ZONE ACCOUNT — change the account (owner) of ZONE to ACCOUNT.
  • zone set-kind ZONE KIND — change the kind of ZONE to KIND (primary, secondary, native, producer, consumer).
  • zone set-option ZONE [producer | consumer] [coo | unique | group] VALUE [VALUE ...] — set or remove an option for ZONE. providing an empty value removes an option.
  • zone set-options-json ZONE JSONFILE — change the options of ZONE to the contents of JSONFILE.
  • zone zonemd-verify-file ZONE FILE — validate ZONEMD for ZONE read from FILE.

🎀 SECONDARY ZONE COMMANDS 🎀

  • zone change-primary ZONE PRIMARY [PRIMARY]... — change the primaries for secondary zone ZONE to new primaries PRIMARY. all PRIMARYs need to to be space-separated IP addresses with an optional port. (yep, "to to" — original says it, we're keeping it, she's got a stutter and she's adorable 🫶)
  • zone create-secondary ZONE PRIMARY [PRIMARY]... — create a new secondary zone ZONE with primaries PRIMARY. all PRIMARYs need to to be space-separated IP addresses with an optional port.

okay bestie that's part one, and there is so much more coming, so don't go anywhere 💖

okay bestie this is the section where things get ✨secure✨. Several commands down here mess with the DNSSEC keys and options for zones. Some of them need an ALGORITHM set, and here's the whole list of what's supported, no gatekeeping:

  • rsasha1
  • rsasha1-nsec3-sha1
  • rsasha256
  • rsasha512
  • ecdsa256
  • ecdsa384
  • ed25519
  • ed448
NOTE: ed25519 and ed448 are only gonna be available if the right cryptographic libraries were chillin' around while PowerDNS got compiled on your particular system. So if they're missing, it's not you, it's your build. 🙈

So besides the algorithm, some of the commands below might ask you for a key size in bits. Here's the tea: for ECC algorithms you can just omit the key size entirely, because each one only supports a single valid size. For ECDSA256 and ED25519, it's 256; for ECDSA384, it's 384; and for ED448, it is... 456. yes really. iconic of it. 👑

  • zone dnssec-disable ZONE — deactivates every single key and unsets PRESIGNED in ZONE. bye keys 💅
  • zone export-dnskey ZONE KEY_ID — exports the DNSKEY and DS of the key with key id KEY_ID inside zone ZONE, straight to standard output.
  • zone export-ds ZONE — exports all the KSK DS records for ZONE to standard output. all of them. periodt.
  • zone list-keys [ZONE] — lists DNSSEC info for every key, or just for ZONE if you pass one. Throw in --verbose or -v and it'll also include the keys for disabled or empty zones. sneaky little bonus ✨
  • zone rectify ZONE — calculates the 'ordername' and 'auth' fields for a zone called ZONE so they comply with DNSSEC settings. super useful for fixing up migrated data, fr fr.
  • zone rectify-all — same thing but for all the zones, so they all comply with DNSSEC settings. also great for fixing up migrated data. go off.
  • zone secure ZONE — configures a zone called ZONE with reasonable DNSSEC settings. > bestie, you should manually run pdnsutil zone rectify afterwards, don't forget. 🙈
  • zone secure-all [increase-serial] — configures all zones that aren't currently signed with reasonable DNSSEC settings. If you set increase-serial it'll bump the serial of those zones too. > and yes, you should manually run pdnsutil zone rectify-all afterwards. no skipping. 💅
  • zone set-nsec3 ZONE ['HASH-ALGORITHM FLAGS ITERATIONS SALT'] [narrow] — sets NSEC3 parameters for this zone. The quoted params are 4 values used for the NSEC3PARAM record, and they decide how NSEC3 records get created. The NSEC3 parameters must be quoted on the command line. HASH-ALGORITHM has to be 1 (SHA-1). Setting FLAGS to 1 enables NSEC3 opt-out operation — only do this if you know you actually need it. For ITERATIONS, please go consult RFC 5155, iykyk.

And lowkey be aware that a high number might overload validating resolvers, and that a limit can be set with max-nsec3-iterations in pdns.conf. The SALT is a hexadecimal string encoding the bits for the salt, or - to use no salt.

Setting narrow makes PowerDNS send out "white lies" (RFC 7129) about the next secure record to prevent zone enumeration. Instead of looking it up in the database, it'll send out the hash + 1 as the next secure record. Narrow mode requires online signing capabilities by the nameserver and therefore zone transfers are denied. no transfers for you 🚫

If you only pass the zone as argument, the 4-parameter quoted string defaults to '1 0 0 -', as recommended by RFC 9276. slay.

A sample commandline would be:

pdnsutil zone set-nsec3 powerdnssec.org '1 1 1 ab' narrow
WARNING: If running in RSASHA1 mode (algorithm 5 or 7), switching from NSEC to NSEC3 will require a DS update in the parent zone. ⚠️
  • zone set-presigned ZONE — switches ZONE to presigned operation, utilizing in-zone RRSIGs.
  • zone set-publish-cdnskey ZONE [delete] — sets ZONE to publish CDNSKEY records. Add 'delete' to publish a CDNSKEY with a DNSSEC delete algorithm. cute.
  • zone set-publish-cds ZONE [DIGESTALGOS] — sets ZONE to respond to queries for its CDS records. The optional argument DIGESTALGOS should be a comma-separated list of DS algorithms to use. By default this is 2 (SHA-256). 0 will publish a CDS with a DNSSEC delete algorithm.
  • zone show ZONE — shows various details of the zone called ZONE, including all its DNSSEC related settings. the vibes check 💖
  • zone unset-nsec3 ZONE — converts ZONE to NSEC operations. > WARNING: If running in RSASHA1 mode (algorithm 5 or 7), switching from NSEC to NSEC3 will require a DS update at the parent zone! ⚠️
  • zone unset-presigned ZONE — disables presigned operation for ZONE.
  • zone unset-publish-cdnskey ZONE — sets ZONE to stop publishing CDNSKEY records.
  • zone unset-publish-cds ZONE — sets ZONE to stop responding to queries for its CDS records.

🔑 ZONE KEY COMMANDS 🔑

the key management era. let's go.

  • zone activate-key ZONE KEY_ID — activates a key with id KEY_ID within a zone called ZONE.
  • zone add-key ZONE [KSK,ZSK] [active,inactive] [published,unpublished] ALGORITHM [KEYBITS] — creates a new key for zone ZONE, and makes it a KSK (that's the default) or a ZSK, with the specified ALGORITHM and KEYBITS. If KEYBITS is omitted, the value of setting-default-ksk-size or setting-default-zsk-size gets used instead.

The key is inactive by default, so set it to active if you want it to immediately start signing ZONE. The key is published in the zone by default, so set it to unpublished to keep it from being returned in a DNSKEY query — which is super useful for algorithm rollovers. ✨

It prints the id of the added key.

  • zone deactivate-key ZONE KEY_ID — deactivates a key with id KEY_ID within a zone called ZONE.
  • zone export-key ZONE KEY_ID — exports the full (private) key with key id KEY_ID inside zone ZONE to standard output. The format used is compatible with BIND and NSD/LDNS. 🔥
  • zone export-key-pem ZONE KEY_ID — exports the full (private) key with key id KEY_ID inside zone ZONE to standard output in the PEM file format. That format is compatible with many non-DNS software products, so it plays nice with the outside world. 🫶
  • zone generate-key {KSK,ZSK} [ALGORITHM] [KEYBITS] — generates a ZSK or KSK with the specified algorithm and bits and prints it on standard output. If ALGORITHM isn't set, ECDSA256 is used. If KEYBITS isn't set, an appropriate keysize gets picked for the ALGORITHM: for RSA keys that's 2048 bits for KSK and 1024 bits for ZSK; for ECC keys it's the algorithm-required size mentioned above. so hands-off, it handles it.
  • zone import-key ZONE FILE [KSK,ZSK] [active,inactive] [published,unpublished] — imports from FILE a full (private) key for the zone ZONE. The format used is compatible with BIND and NSD/LDNS. KSK or ZSK specifies the flags this key should have on import. Defaults to KSK, active and published. Prints the id of the added key. 💖
  • zone import-key-pem ZONE FILE ALGORITHM {KSK,ZSK} — imports from PEM FILE a full (private) key for the zone ZONE with a specified ALGORITHM. The format used is compatible with many non-DNS software products. KSK or ZSK specifies the flags this key should have on import. Prints the id of the added key.
  • zone publish-key ZONE KEY_ID — publishes the key with id KEY_ID within zone ZONE.
  • zone remove-key ZONE KEY_ID — removes a key with id KEY_ID from zone ZONE. bye bestie 👋
  • zone unpublish-key ZONE KEY_ID — unpublishes the key with id KEY_ID within zone ZONE.

🎀 OTHER/MISCELLANEOUS COMMANDS 🎀

the little grab bag of randomness. every friend group has one.

  • b2b-migrate OLD NEW — migrates data from one backend to another. Needs launch=OLD,NEW in the configuration. don't forget that part or it's giving nothing. 🙈
  • backend-cmd BACKEND CMD [CMD...] — sends a text command to a backend for execution. GSQL backends will take SQL commands, other backends may take different things. > Be careful! ⚠️ like actually. this one has main character energy and not always in a good way.
  • backend-lookup BACKEND NAME [TYPE [CLIENT_IP_SUBNET]] — performs a backend record lookup.
  • bench-db [FILE] — performs a benchmark of the backend-database. FILE can be a file with a list, one per line, of zone names to use for this. If FILE isn't specified, powerdns.com is used.
  • create-bind-db FILENAME — creates a DNSSEC database (sqlite3) at FILENAME for the BIND backend. > Remember to set bind-dnssec-db=*FILE* in your pdns.conf. 💅
  • hash-password [WORK_FACTOR] — this convenience command reads a password (not echoed, so nobody's watching 👀) from standard input and returns a hashed and salted version, for use as a webserver password or api key. You can optionally specify an scrypt work factor, in powers of two — otherwise it defaults to 1024.
  • ipdecrypt IP_ADDRESS PASSPHRASE_OR_KEY [key] — decrypts an IP address according to the 'ipcipher' standard. If the passphrase is a base64 key, add the word "key" after it.
  • ipencrypt IP_ADDRESS PASSPHRASE_OR_KEY [key] — encrypts an IP address according to the 'ipcipher' standard. If the passphrase is a base64 key, add the word "key" after it. same deal, opposite direction ✨
  • list-algorithms [with-backend] — lists all DNSSEC algorithms supported, and optionally also lists the cryptographic library used if "with-backend" is specified. very demure, very mindful. 🌸
  • test-schema ZONE — tests the database schema, and this creates the zone ZONE. (yes it does both, that's the vibe.)
  • raw-lua-from-content TYPE CONTENT — displays record contents in a form suitable for dnsdist's SpoofRawAction.

👀 SEE ALSO 👀

pdns_server (1), pdns_control (1)

💖 AUTHOR 💖

PowerDNS.COM BV

PowerDNS.COM BV

and that's the whole page bestie!! 🦋 this one was brought to you by version vibes dated Aug 05, 2026, from your favorite PDNSUTIL(1) girlie — go forth and manage those zones, you absolute legend 💅👑

📦 where this page comes from