ROLLINIT(1)

📦

version 2.2.3 · 2 versions

2.2.3 · fedora 43 (latest)
2.2.3 · fedora 44

💖 ROLLINIT — the `rollinit` manual page, bestie edition 💖

okay so this is ROLLINIT(1) from the User Contributed Perl Documentation corner of the universe, and it's literally all about rollinit, the lil tool that spins up brand-new rollrec records for a DNSSEC-Tools rollrec file. buckle up, it's giving very "trust me I know what I'm doing" energy 🎀

✨ NAME ✨

rollinit — Create new rollrec records for a DNSSEC-Tools rollrec file.

🌸 SYNOPSIS 🌸

rollinit [options] <zonename1> ... <zonenameN>

🦋 DESCRIPTION 🦋

okay so rollinit makes shiny new rollrec entries for a rollrec file. that rollrec file is the one rollerd is gonna use to manage key rollover for all the zones you name. slay.

the freshly generated rollrec entries get written to standard output, unless you hand it the -out option. periodt.

a rollrec entry looks exactly like this:

roll "example.com"
    zonename        "example.com"
    zonefile        "example.com.signed"
    keyrec          "example.com.krf"
    zonegroup       "example-zones"
    kskphase        "0"
    zskphase        "0"
    administrator   "bob@bobhost.example.com"
    directory       "/var/dns/zones/example.com"
    loglevel        "phase"
    ksk_rolldate    " "
    ksk_rollsecs    "0"
    zsk_rolldate    " "
    zsk_rollsecs    "0"
    maxttl          "604800"
    display         "1"
    phasestart      "Mon Jan 9 16:00:00 2006"
    # optional records for RFC5011 rolling:
    istrustanchor   "no"
    holddowntime    "60D"

the keywords roll and skip are basically the vibe check that tells rollerd whether to process or ignore a particular rollrec entry. roll records are what you get by default; skip entries show up if you pass the -skip option. 💅

the roll line has a name, and that name is what sets it apart from every other rollrec entry in the file. the zonename field gets set to the name of the zone. these two are often the same thing, but like — that's not a requirement, bestie. rollinit will set them to the same value unless you use the -rollrec option. iykyk.

the zonefile and keyrec fields get set according to your command-line options and arguments. the way the rollrec's actual values get generated is a lil complex ngl, and it's all spelled out in the ZONEFILE And KEYREC FIELDS section below. 🫶

the zonegroup field is how you associate a set of rollrecs together, so they can all be controlled by a single rollctl -group command. you can specify multiple zonegroups in a comma-separated list. leading and trailing whitespace gets deleted, but internal whitespace is allowed. this field is optional, and rollinit only sets it if you pass the -zonegroup option. (and yes, even though it says "zone", it's actually talking about the name of the rollrec entries. the terminology is giving chaos but we move.)

the administrator field gets set to the email address of the person (or person*s*, if that address is actually a mailing list) considered to be the responsible person for the zone.

the directory field gets set to the directory that contains the the files for the zone. those files include the zone file, the signed zone file, and the keyrec file.

the loglevel field gets set to the level of log messages that rollerd should produce for this zone. the log level includes those messages at a greater priority to the specified level, so a level of "phase" will also include "err" and "fatal" messages. inclusivity icon.

the kskphase and zskphase fields indicate the rollover phase for the zone's KSK and ZSK keys. the value 0 means the zone is in normal operation (non-rollover) for that key type. a non-zero phase (1-7 for KSKs; 1-4 for ZSKs) means the zone is mid-process of rolling the keys. only one of these fields should ever be non-zero at a particular time. if both are zero, then no rollover operations are taking place. it's giving ✨balance✨.

the ksk_rolldate and ksk_rollsecs fields indicate when KSK rollover started. if the values are a blank and zero, respectively, then the zone is not in KSK rollover.

the zsk_rolldate and zsk_rollsecs fields indicate when ZSK rollover started. if the values are a blank and zero, respectively, then the zone is not in ZSK rollover.

the Boolean display field indicates if blinkenlights should display information about this zone. 🌈

the maxttl field contains the maximum TTL value from the zone file.

the phasestart fields contains the date that the current rollover phase was entered.

rollrec files also have the zsargs field, which holds user-specified options for zonesigner. this field is set during rollerd execution when the administrator determines that some zone fields should be modified. it is not an initial rollrec field, and consequently cannot be specified by rollinit. 💀

the istrustanchor field specifies whether to roll the KSK keys in a manner compliant with any remote validating resolver using the KSK as a trust-anchor. if set to "yes" then 60 days will be the minimum wait time during phase 3 of KSK rolling, to ensure remote validators can properly follow the steps needed as specified by RFC5011. that 60-day default can be changed via the holddowntime field.

🎀 INFO ROLLRECS 🎀

starting with DNSSEC-Tools version 1.15, each rollrec file should have an info rollrec. this special rollrec entry contains information about the rollrec file itself and does not contain any zone information. its contents should not be modified by anything but the DNSSEC-Tools utilities. hands off bestie, that's not yours 🫶

💜 ZONEFILE and KEYREC FIELDS 💜

the zonefile and keyrec fields may be given by using the -zonefile and -keyrec options, or default values may be used.

the default values use the rollrec's zone name, taken from the command line, as a base. .signed is appended to the zone name for the zone file; .krf is appended to the zone name for the keyrec file. cute, consistent, iconic.

if -zonefile or -keyrec are specified, then the options values are used in one of two ways:

a single zone name is given on the command line. the option values for -zonefile and/or -keyrec are used for the actual rollrec fields.
multiple zone names are given on the command line. the option values for -zonefile and/or -keyrec are used as templates for the actual rollrec fields. the option values must contain the string =. this string is replaced by the zone whose rollrec is being created.

see the EXAMPLES section for examples of how options are used by rollinit. 👑

💅 OPTIONS 💅

rollinit may be given the following options:

-rollrec rollrec-name — this specifies the name of the rollrec record. this value may contain spaces. if this option is not specified, it will be set to the same value as the zonename field. see the ZONEFILE And KEYREC FIELDS and EXAMPLES sections for more details.
-zonefile zonefile — this specifies the value of the zonefile field. see the ZONEFILE And KEYREC FIELDS and EXAMPLES sections for more details.
-keyrec keyrec-file — this specifies the value of the keyrec field. see the ZONEFILE And KEYREC FIELDS and EXAMPLES sections for more details.
-zg zonegroup
-zonegroup zonegroup — this specifies the value of the zonegroup field. this field is optional.
-admin — this specifies the value of the administrator field. if it is not given, an administrator field will not be included for the record.
-directory — this specifies the value of the directory field. if it is not given, a directory field will not be included for the record.
-loglevel — this specifies the value of the loglevel field. if it is not given, a loglevel field will not be included for the record.
-skip — by default, roll records are generated. if this option is given, then skip records will be generated instead.
-out output-file — the new rollrec entries will be appended to output-file. the file will be created if it does not exist.

if this option is not given, the new rollrec entries will be written to standard output.

-help — display a usage message.
-Version — display version information for rollinit and DNSSEC-Tools.

…and that's where part 1 wraps, bestie. more incoming, don't go anywhere 🦋

🎀 EXAMPLES 🎀

okay bestie, here's where it gets visual. these examples show you exactly how rollinit deals with its options and how the new rollrecs come out the other side. Example 1 gives you the whole rollrec record, every field, no crumbs left. and because we're being nice about space, all the other examples just show the freshly made zonefile and keyrec records. ✨

oh and also: an info rollrec shows up in the first example too. it's not in the rest of them, again, space. 🫶

🌸 Example 1. One zone, no options 🌸

this one is just you handing rollinit a single zone and zero options. look at her go:

    $ rollinit example.com

        skip    "info rollrec"
            version         "2"

        roll    "example.com"
            zonename        "example.com"
            zonefile        "example.com.signed"
            keyrec          "example.com.krf"
            kskphase        "0"
            zskphase        "0"
            ksk_rolldate    " "
            ksk_rollsecs    "0"
            zsk_rolldate    " "
            zsk_rollsecs    "0"
            maxttl          "0"
            display         "1"
            phasestart      "new"

🌸 Example 2. One zone, `-zonefile` option 🌸

single zone, and this time you're passing -zonefile. iconic.

    $ rollinit -zonefile signed-example example.com
        roll    "example.com"
            zonename        "example.com"
            zonefile        "signed-example"
            keyrec          "example.com.krf"

🌸 Example 3. One zone, `-keyrec` option 🌸

same energy, but now it's the -keyrec option doing the work:

    $ rollinit -keyrec x-rrf example.com
        roll    "example.com"
            zonename        "example.com"
            zonefile        "example.com.signed"
            keyrec          "x-rrf"

🌸 Example 4. One zone, `-zonefile` and `-keyrec` options 🌸

both options, one zone, no drama:

    $ rollinit -zonefile signed-example -keyrec example.rrf example.com
        roll    "example.com"
            zonename        "example.com"
            zonefile        "signed-example"
            keyrec          "example.rrf"

🌸 Example 5. One zone, `-skip` option 🌸

this is the rollrec you get when you hit a single zone with -skip:

ngl the original blurb right here says "with the -zonefile and -keyrec options" — bestie that is not what's happening in the command below, but we're keeping every word of the page exactly as it is. 💀

    $ rollinit -skip example.com
        skip    "example.com"
            zonename        "example.com"
            zonefile        "example.com.signed"
            keyrec          "example.com.krf"

🌸 Example 6. One zone, `-rollrec` option 🌸

single zone, but you're naming the rollrec yourself with -rollrec:

    $ rollinit -rollrec test example.com
        roll    "test"
            zonename        "example.com"
            zonefile        "example.com.signed"
            keyrec          "example.com.krf"

🌸 Example 7. Multiple zones, no options 🌸

now we're in our multi-zone era. several zones, zero options:

    $ rollinit example1.com example2.com
        roll    "example1.com"
            zonename        "example1.com"
            zonefile        "example1.com.signed"
            keyrec          "example1.com.krf"

        roll    "example2.com"
            zonename        "example2.com"
            zonefile        "example2.com.signed"
            keyrec          "example2.com.krf"

🌸 Example 8. Multiple zones, `-zonefile` option 🌸

watch the = template do its thing — it gets swapped out for each zone name:

    $ rollinit -zonefile =-signed example1.com example2.com
        roll    "example1.com"
            zonename        "example1.com"
            zonefile        "example1.com-signed"
            keyrec          "example1.com.krf"

        roll    "example2.com"
            zonename        "example2.com"
            zonefile        "example2.com-signed"
            keyrec          "example2.com.krf"

🌸 Example 9. Multiple zones, `-keyrec` option 🌸

same = template energy, but on -keyrec:

    $ rollinit -keyrec zone-=-keyrec example1.com example2.com
        roll    "example1.com"
            zonename        "example1.com"
            zonefile        "example1.com.signed"
            keyrec          "zone-example1.com-keyrec"

        roll    "example2.com"
            zonename        "example2.com"
            zonefile        "example2.com.signed"
            keyrec          "zone-example2.com-keyrec"

🌸 Example 10. Multiple zones, `-zonefile` and `-keyrec` options 🌸

both options, both using the = template. chef's kiss. 💅

    $ rollinit -zonefile Z-= -keyrec =K example1.com example2.com
        roll    "example1.com"
            zonename        "example1.com"
            zonefile        "Z-example1.com"
            keyrec          "example1.comK"

        roll    "example2.com"
            zonename        "example2.com"
            zonefile        "Z-example2.com"
            keyrec          "example2.comK"

🌸 Example 11. Single zone, `-zonefile` and `-keyrec` options with template 🌸

one zone, both options, and both of them use the multi-zone = template:

    $ rollinit -zonefile Z-= -keyrec =.K example.com
        roll    "example.com"
            zonename        "example.com"
            zonefile        "Z-="
            keyrec          "=.K"

and here's the tea: this is probably not what you wanted, because the = just sits there inside the zonefile and keyrec field values. 🙈

🌸 Example 12. Multiple zones, `-zonefile` and `-keyrec` options without template 🌸

several zones, both options, and this time no multi-zone = template anywhere:

    $ rollinit -zonefile ex.zone -keyrec ex.krf example1.com example2.com
        roll    "example1.com"
            zonename        "example1.com"
            zonefile        "ex.zone"
            keyrec          "ex.krf"

        roll    "example2.com"
            zonename        "example2.com"
            zonefile        "ex.zone"
            keyrec          "ex.krf"

and again, this may not be what you wanted, since every single rollrec ends up with the same zonefile and keyrec field values. 😭

🌸 Example 13. Multiple zones, `-rollrec` option 🌸

several zones plus -rollrec — and look, the rollrec names have a space in them:

    $ rollinit -rollrec "= entry" example1.com example2.com
        roll    "example1.com entry"
            zonename        "example1.com"
            zonefile        "example1.com.signed"
            keyrec          "example1.com.krf"

        roll    "example2.com entry"
            zonename        "example2.com"
            zonefile        "example2.com.signed"
            keyrec          "example2.com.krf"

🌸 Example 14. Multiple zones, `-zg` option 🌸

a set of zones, all gathered up with -zg:

    $ rollinit -zg "example zones" example1.com example2.com
        roll    "example1.com"
            zonename        "example1.com"
            zonefile        "example1.com.signed"
            keyrec          "example1.com.krf"
            zonegroup       "example zones"

        roll    "example2.com"
            zonename        "example2.com"
            zonefile        "example2.com.signed"
            keyrec          "example2.com.krf"
            zonegroup       "example zones"

🌸 Example 15. One zone, Two zonegroups 🌸

and finally, a single zone getting handed a set of two zonegroups:

    $ rollinit -zg "customers, paid up" example.com
        roll    "example1.com"
            zonename        "example.com"
            zonefile        "example.com.signed"
            keyrec          "example.com.krf"
            zonegroup       "customers, paid up"

👑 COPYRIGHT 👑

🦋 AUTHOR 🦋

Wayne Morrison, tewok@tislabs.com

🌈 SEE ALSO 🌈

lsroll(1), rollerd(8), rollchk(8), zonesigner(8)
Net::DNS::SEC::Tools::keyrec.pm(3), Net::DNS::SEC::Tools::rollrec.pm(3)
file-keyrec.pm(5), file-rollrec.pm(5)

and that's the whole page, bestie, you made it to the end 🫶 this one's from perl v5.42.0, dated 2025-07-23, and it lives under the name ROLLINIT(1). go forth and init those rollrecs, you absolute main character. ✨💖

📦 where this page comes from

fedora 43: dnssec-tools 2.2.3-30.fc43 · LicenseRef-Callaway-BSD
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-18: a language model's rewrite of the original, under its terms

ROLLINIT(1)

💖 ROLLINIT — the rollinit manual page, bestie edition 💖

✨ NAME ✨

🌸 SYNOPSIS 🌸

🦋 DESCRIPTION 🦋

🎀 INFO ROLLRECS 🎀

💜 ZONEFILE and KEYREC FIELDS 💜

💅 OPTIONS 💅

🎀 EXAMPLES 🎀

🌸 Example 1. One zone, no options 🌸

🌸 Example 2. One zone, -zonefile option 🌸

🌸 Example 3. One zone, -keyrec option 🌸

🌸 Example 4. One zone, -zonefile and -keyrec options 🌸

🌸 Example 5. One zone, -skip option 🌸

🌸 Example 6. One zone, -rollrec option 🌸