GENKRF(1)

📦 version 2.2.3, in arch rolling

💖 genkrf(1) — the perl-contributed man page, but make it make sense 💖

okay bestie, buckle up, this is genkrf from the User Contributed Perl Documentation section and it's literally about making keyrec files out of your KSK and/or ZSK files ✨

🌸 NAME 🌸

genkrf — generate a keyrec file from Key Signing Key (KSK) and/or Zone Signing Key (ZSK) files 🎀

🦋 SYNOPSIS 🦋

genkrf [options] <zone-file> [<signed-zone-file>]

that's it, that's the whole vibe check 💅

✨ DESCRIPTION ✨

so genkrf does the thing where it generates a keyrec file from KSK and/or ZSK files. and like, it's not just sitting there — it will generate brand-new KSK and ZSK keys if it needs them 🔥

the name of the keyrec file it's gonna generate? that comes from the -krfile option. if you don't give that option, no worries, it just uses zone-name.krf as the keyrec file name. and heads up — if the keyrec file already exists, it will be overwritten with new keyrec definitions. so don't get attached to the old one 😭

the zone-file argument is required, no cap. it's the name of the zone file that the signed zone file was created from. the optional signed-zone-file argument is the name of the signed zone file. if you don't pass it, it defaults to zone-file.signed. and tbh? the signed zone file field is, in effect, a dummy field, because ✨the zone file is not actually signed✨ — it's giving placeholder energy, but that's just how it is 🙈

💜 OPTIONS 💜

genkrf has a bunch of options that help with creating the keyrec file. these options get set to the first value found from this search path:

command line options
DNSSEC-Tools configuration file
DNSSEC-Tools defaults

check tooloptions.pm(3) for more details on that. any exceptions to this are called out in the individual option descriptions 🫶

the genkrf options are described below, and yes we're going through all of them 💖

🌈 General genkrf Options 🌈

  • -zone zone-name — specifies the name of the zone. if you don't give it, then zone-file gets used as the name of the zone. easy 💫
  • -krfile keyrec-file — specifies the name of the keyrec file to be generated. if you don't give it, then zone-name.krf is used.
  • -algorithm algorithm — specifies the algorithm used to generate encryption keys 🔐
  • -endtime endtime — specifies the time that the signature on the zone expires, measured in seconds ⏰
  • -random random-device — the source of randomness used to generate the zone's keys. see the man page for dnssec-signzone for the valid format of this field 🎲
  • -verbose — display additional messages during processing. if you give this option at least once, you get a message saying the keyrec file was generated successfully 🎉. if you give it twice, then the values of all the options get displayed too. double verbose, double iconic 👑
  • -Version — displays the version information for genkrf and the DNSSEC-Tools package 📦
  • -help — display a usage message 🆘
  • -kskcur KSK-name — specifies the Current KSK's key file being used to sign the zone. if you don't give this option, a new KSK will be created ✨
  • -kskcount KSK-count — specifies the number of KSK keys that will be generated. if you don't give it, the default given in the DNSSEC-Tools configuration file gets used.
  • -kskdir KSK-directory — specifies the absolute or relative path of the directory where the KSK resides. if you don't give it, it defaults to the current directory "." 📁
  • -ksklength KSK-length — specifies the length of the KSK encryption key 📏
  • -ksklife KSK-lifespan — specifies the lifespan of the KSK encryption key. ngl, this lifespan is not inherent to the key itself — it's only used to determine when the KSK must be rolled over 🔄
  • -zskcur ZSK-name — specifies the current ZSK being used to sign the zone. if you don't give this option, a new ZSK will be created ✨
  • -zskpub ZSK-name — specifies the published ZSK for the zone. if you don't give this option, a new ZSK will be created.
  • -zskcount ZSK-count — specifies the number of current and published ZSK keys that will be generated. if you don't give it, the default given in the DNSSEC-Tools configuration file gets used.
  • -zskdir ZSK-directory — specifies the absolute or relative path of the directory where the ZSKs reside. if you don't give it, it defaults to the current directory "." 📁
  • -zsklength ZSK-length — specifies the length of the ZSK encryption key 📏
  • -zsklife ZSK-lifespan — specifies the lifespan of the ZSK encryption key. same deal as the KSK one: this lifespan is not inherent to the key itself, it's only used to determine when the ZSK must be rolled over 🔄

Copyright 2005-2014 SPARTA, Inc. All rights reserved. see the COPYING file included with the DNSSEC-Tools package for details 📜

🧚 AUTHOR 🧚

Wayne Morrison, tewok@tislabs.com — ty wayne, you ate 💅

⭐ SEE ALSO ⭐

and that's the whole page bestie 🫶 this one's perl v5.44.0, dated 2026-10-17, and it's the GENKRF(1) page — go forth and generate those keyrec files, you've got this 💖✨🌸

📦 where this page comes from