CLEANKRF(1)

📦 version 2.2.3, in arch rolling

✨ CLEANKRF(1) ✨

okay bestie, so this is a User Contributed Perl Documentation page for cleankrf — yes, it's Perl, yes it's from the perl v5.44.0 era, and yes it's about DNSSEC keyrec files 💅 don't worry, I'll walk you through it 🫶

🌸 NAME 🌸

cleankrf — literally cleans a DNSSEC-Tools keyrec file of old data ✨

🎀 SYNOPSIS 🎀

cleankrf [options] <keyrec-files>

💖 DESCRIPTION 💖

So cleankrf cleans old data out of a whole set of DNSSEC-Tools keyrec files. And what counts as "old data"? Three things, bestie: obsolete signing sets, orphaned keys, and obsolete keys. Let's break it down 🔥

Obsolete signing sets are set keyrecs that no zone keyrec references. And listen — revoked signing sets are considered obsolete by cleankrf, that's just how it is 🙈

Orphaned keys are KSK and ZSK key keyrecs that no set keyrec references.

Obsolete keys are key keyrecs whose keyrec_type is kskobs or zskobs.

And here's a fun one 👑 — cleankrf's exit code is the count of orphaned and obsolete keyrecs found. It's giving "your exit code is your receipts", honestly iconic.

🦋 OPTIONS 🦋

  • -count — shows a final count of the old keyrecs found in the keyrec files. The way this one is special? It lets the count show up even if you passed -quiet ✨
  • -list — the key keyrecs do get checked for old keyrecs, but they are not removed from the keyrec file. Instead, the names of the old keyrecs are displayed 👀
  • -rm — deletes the key files, both .key and .private, from orphaned and expired keyrecs 🗑️
  • -quiet — displays no output 🤫
  • -verbose — displays output about referenced keys and unreferenced keys 🔍
  • -Version — displays the version information for cleankrf and the DNSSEC-Tools package 💜
  • -help — displays a usage message 🆘

Copyright 2004-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details. (read the COPYING file, bestie, it's the rules 📜)

🧚 AUTHOR 🧚

Wayne Morrison, tewok@tislabs.com — ty for your service king 👑

⭐ SEE ALSO ⭐

  • fixkrf(8)
  • lskrf(8)
  • zonesigner(8)

Net::DNS::SEC::Tools::keyrec.pm(3)

file-keyrec.pm(5)

ngl the exit code being a count is lowkey the most main character energy thing in this whole page 💀

and that's the whole page, bestie 🎀 mwah 💋 — this was CLEANKRF(1), page generated from perl v5.44.0 on 2026-10-17, and the manual name up top was CLEANKRF(1) in case you forgot already 😭 slay ✨🦋💜

📦 where this page comes from