GETDNSKEYS(1)

okay bestie, welcome to GETDNSKEYS(1) from the User Contributed Perl Documentation — this is the manual page for getdnskeys, and it's literally all about managing DNSKEY lists. 💖

✨ NAME ✨

getdnskeys — manage lists of DNSKEYs from DNS zones, bestie. 🎀

🌸 SYNOPSIS 🌸

    getdnskeys [-i file] [-o file] [-k] [-T] [-t] [-v] [zones]

🦋 DESCRIPTION 🦋

okay so getdnskeys manages lists of DNSKEYs from DNS zones. You can use it to retrieve and compare DNSKEYs. The output from getdnskeys may be included — directly or indirectly — in a named.conf file. no cap, that's the whole vibe. ✨

💅 OPTIONS 💅

getdnskeys takes the following options, bestie:

• -i path — reads path as a named.conf with which to compare key lists. 🫶
• -k — only looks for Key Signing Keys (KSKs); all other keys are ignored. 👑
• -o file — writes the results to file. 🎀
• -T — checks the current trusted key list from named.conf. 🔥
• -t — encloses output in needed named.conf syntax markers. ✨
• -v — turns on verbose mode for additional output. 💜
• -Version — displays the version information for getdnskeys and the DNSSEC-Tools package. 🌈
• -h — gives a help message. 🦋

🌟 EXAMPLES 🌟

This getdnskeys will retrieve the KSK for example.com:

    getdnskeys -o /etc/named.trustkeys.conf -k -v -t example.com

This getdnskeys will check saved keys against a live set of keys:

    getdnskeys -i /etc/named.trustkeys.conf -T -k -v -t

This getdnskeys will automatically update a set of saved keys:

    getdnskeys -i /etc/named.trustkeys.conf -k -t -T -v
               -o /etc/named.trustkeys.conf

🚨 SECURITY ISSUES 🚨

🚨 security tea: Currently this does not validate new keys placed in the file in any way, nor does it validate change over keys which have been added. 😭

It also does not handle revocation of keys. 💀

It should prompt you before adding a new key so that you can always run the auto-update feature. 🙈

---

💖 that's the tea: the footer says perl v5.44.0, dated 2026-10-17, and the page is GETDNSKEYS(1). slay, you made it to the end. 🫶