DTINITCONF(1)

📦 version 2.2.3, in arch rolling

💖 dtinitconf — the DNSSEC-Tools config file generator, bestie edition 🎀

okay so picture this: you're in the DTINITCONF(1) section of the manual (User Contributed Perl Documentation, if we're being fancy ✨) and you need a DNSSEC-Tools configuration file. That's literally what dtinitconf is here for. Let's get into it 🫶

✨ NAME ✨

dtinitconf — creates a DNSSEC-Tools configuration file. that's it. that's the whole job. she's iconic and she knows it 💅

🌸 SYNOPSIS 🌸

dtinitconf [options]

🦋 DESCRIPTION 🦋

So the dtinitconf program initializes the DNSSEC-Tools configuration file. By default, the actual configuration file gets created — like, the real one — though you can tell her to create a file you specify instead. And here's the respectful part: existing files, whether it's the default one or one you named yourself, will not be overwritten unless you specifically direct her to do it. she's not gonna stomp on your stuff without permission, periodt 🙈

Every single configuration field can be individually specified on the command line. But also? She'll prompt you for the fields too, with default values pulled straight from the DNSSEC-Tools defaults.pm module. And if you hand her the -noprompt option, then a default configuration file gets created (modulo whatever you passed on the command line, of course) with zero chatting. no small talk, just vibes 😌

Configuration entries get created for several BIND programs, and finding those programs is a whole little journey 🧚 So: several locations on the system get searched to find where these programs live. First, the directories in the path environment variable get checked, and the names of any directories that contain the BIND programs are saved. Next, several common locations for BIND programs get checked, and again — the names of directories that contain the BIND programs are saved. After collecting all these directories, the user gets presented with this list and may choose to use whichever set is desired. A little menu moment, very choose-your-own-adventure ⭐ And if no directories are found that contain the BIND programs at all? Then the user gets prompted for the proper location. no cap, she'll just ask 🔥

Now the directory situation, because this part matters 👑

If the configuration file's parent directory does not exist, then an attempt is made to create the directory. The new directory's ownership will be set to root for the owner and dnssec for the group — assuming the dnssec group exists. And heads up: writability checks for the directory will not be performed if the -outfile option is given.

💀 real talk on that last bit: pass -outfile and those writability checks just don't happen. that's the documented behaviour, not me being dramatic.

🌸 OPTIONS 🌸

ok so dtinitconf has a whole pile of options and they all control what ends up in your brand-new DNSSEC-Tools configuration file 💖. Every single entry in that config file has a matching command-line option, bestie — one-to-one, no cap. They're listed below in logical little groups so it's not complete chaos ✨

these ones are all about creating and managing your encryption keys 👑

  • -algorithm algorithm — picks the crypto algorithm. the value has to be one that the dnssec-keygen you've actually got installed recognizes, so no inventing algorithms, bestie 🫶
  • -kskcount KSK-count — the default number of KSK keys that get created for a zone.
  • -ksklength keylen — the default KSK key length that gets handed off to dnssec-keygen.
  • -ksklife lifespan — the default gap between KSK rollovers, measured in seconds. has to sit inside the range set by minlife and maxlife.
ok so important: this value is only used for key rollover. keys do not have a life-time in any other sense. like, don't go thinking your key expires, it doesn't 💀
  • -maxlife maxlifespan — the maximum gap between key rollovers, in seconds. ksklife and zsklife both have to be not greater than this.
same deal: only used for key rollover. keys do not have a life-time in any other sense.
  • -minlife minlifespan — the minimum gap between key rollovers, in seconds. ksklife and zsklife both have to be not less than this.
again: only used for key rollover. keys do not have a life-time in any other sense ✨
  • -zskcount ZSK-count — the default number of ZSK keys created for a zone.
  • -zsklength keylen — the default ZSK key length passed to dnssec-keygen.
  • -zsklife lifespan — the default gap between ZSK rollovers, in seconds. must be within the range of minlife and maxlife.
and yes: only used for key rollover. keys do not have a life-time in any other sense 🎀
  • -random randomdev — the random device generator to pass along to dnssec-keygen.

these deal with signing your zones, mwah 😘

  • -endtime endtime — the zone's default expiration time, passed to dnssec-signzone.

the trustman side of things, iykyk 💜

  • -genroothints roothints — makes a brand-new root.hints file at the location you specify. dtinitconf requires that the file not already exist 🙈 the root.hints file is fetched from http://www.internic.net/zones/named.root. if dtinitconf can't fetch it, that is not considered a fatal error — instead you get a warning message and creation of the config file just keeps on going. resilient queen 💅
  • -ta-contact email — the email address of the trustman administrator.
  • -ta-resolvconf resolvconffile — where the resolv.conf file lives.
  • -ta-smtpserver hostname — the SMTP server for the trustman command.
  • -ta-tmpdir hostname — the temporary directory for the trustman command.

🦋 BIND Options 🦋

BIND-specific functionality, very much its own thing ⭐

  • -rndc rndc-path — rndc is the path to BIND's rndc command.

👑 DNSSEC-Tools Options 👑

all the DNSSEC-Tools-flavoured knobs and dials 🌈

  • -admin email-address — admin is the email address of the DNSSEC-Tools administrator. this is the default address used by the dt_adminmail() routine.
  • -archivedir directory — directory is the archived-key directory. old encryption keys get moved here, but only if they're supposed to be saved and not deleted 📦
  • -autosign — a flag saying rollerd should automatically sign zonefiles it finds are newer than their signed zonefile. if you specify -noautosign, this gets set to false.
  • -binddir directory — directory is the directory holding the BIND programs. if you pass the reserved word "path", then the existence of the BIND programs is not verified when dtinitconf runs — instead, the user's PATH directories get searched for the BIND programs when the DNSSEC-Tools are executed. sneaky but valid ✨
  • -dtdir directory — directory is the directory holding the DNSSEC-Tools programs. same reserved-word situation: pass "path" and the existence of the DNSSEC-Tools programs isn't verified when dtinitconf runs — the user's PATH directories get searched for them when those tools are executed.
  • -entropy_msg — a flag saying zonesigner should display a message about entropy generation. this is primarily dependent on how a system's random number generation is implemented 🔥
  • -mailer-server host — the mail server that dt_adminmail() will contact. this gets passed to Mail::Send.
  • -mailer-server mailtype — the mail type that dt_adminmail() will contact. this gets passed to Mail::Mailer (by way of Mail::Send). any values Mail::Mailer recognizes are fair game here 🫶
  • -noentropy_msg — a flag saying zonesigner should not display a message about entropy generation. again, primarily dependent on the system's random number generation implementation.
  • -roll-loadzone, -no-roll-loadzone — flags saying whether rollerd should have the DNS daemon load zones, or not.
  • -roll-logfile logfile — logfile is the logfile for the rollerd daemon.
  • -roll-loglevel loglevel — loglevel is the logging level for the rollerd daemon.
  • -roll-phasemsg length — length is the default length of phase-related log messages used by rollerd. valid levels are "long" and "short", and "long" is the default 💅 the long message length means a phase description gets included with some log messages. example: the long form of a message about ZSK rollover phase 3 looks like "ZSK phase 3 (Waiting for old zone data to expire from caches)". the short message length means a phase description does not get included with some log messages. example: the short form of that same message looks like "ZSK phase 3".
  • -roll-sleeptime sleep-time — sleep-time is the sleep-time for the rollerd daemon.
  • -roll-username username — username is the user the rollerd daemon will be executed as. if it's a username, it has to correspond to a valid uid; if it's a uid, it has to correspond to a valid username. both directions, no exceptions 😤
  • -roll-logtz logtz — loglevel is the timezone of the message timestamp for rollerd's logfile. (yes, the manpage says loglevel there — we're keeping it exactly as written, bestie 🎀)
  • -zoneerrs error-count — error-count is the maximum error count for zones, used by the rollerd daemon.
  • -savekeys — a flag saying old keys should be moved to the archive directory.
  • -nosavekeys — a flag saying old keys should not be moved to the archive directory, and instead get left in place.
  • -usegui — a flag saying the GUI for specifying command options may be used 🖱️
  • -nousegui — a flag saying the GUI for specifying command options should not be used.
  • -zoneparser parser-module — parser-module is the name of the Perl module used to parse zone files. the default is specified in dnssec_tools_default().

💖 dtinitconf Options 💖

and these ones are dtinitconf's very own, main character energy 👑

  • -outfile conffile — the config file gets written to conffile. if you don't give this, the default config file gets used (the one returned by Net::DNS::SEC::Tools::conf::getconffile()). if conffile is given as -, then the new config file gets written to standard output 🌟 conffile must be writable.
  • -overwrite — with -overwrite, existing output files may be overwritten. without it, if the output file already exists then dtinitconf gives you an error message and exits 🚪
  • -noprompt — with -noprompt, you don't get prompted for any input at all. the config file gets built purely from command-line options and DNSSEC-Tools defaults. guesses get made for the BIND paths, based on the PATH environment variable.
⚠️ WARNING: after using the -noprompt option, the configuration file must be checked to make sure the defaults are appropriate and acceptable for the installation. like, actually check it, bestie, don't just vibe and hope 😭
  • -template — with -template, a default config file gets created — but every single entry is commented out 🙈 the only command line options you may use alongside -template are -outfile and -overwrite.
  • -edit — with -edit, the output file gets edited after it's been created. the EDITOR environment variable is consulted for which editor to use. if EDITOR isn't defined, then the vi editor is used.
  • -verbose — give verbose output 🗣️
  • -Version — displays the version info for dtinitconf and the DNSSEC-Tools package.
  • -help — display a usage message and exit.

Copyright 2006-2014 SPARTA, Inc. All rights reserved. see the COPYING file that comes with the DNSSEC-Tools package for the details 🫶

✨ AUTHOR ✨

Wayne Morrison, tewok@tislabs.com — ty Wayne 💜

🌈 SEE ALSO 🌈

  • dnssec-keygen(8), dnssec-signzone(8), named-checkzone(8), keyarch(8), rollckk(8), rollerd(8), zonesigner(8)
  • Net::DNS::SEC::Tools::conf.pm(3), Net::DNS::SEC::Tools::defaults.pm(3), Net::DNS::SEC::Tools::dnssectools.pm(3), Net::DNS::SEC::Tools::tooloptions.pm(3), QWizard.pm(3)
  • dnssec-tools.conf(5)

aaaand that's the whole page, bestie 🦋 for the record this was perl v5.44.0, dated 2026-10-17, and it's DTINITCONF(1) — go forth and configure your DNSSEC-Tools, you absolute icon 💅✨🍓

📦 where this page comes from