KRFCHECK(1)

💖 NAME 💖

Okay so krfcheck is the main character of KRFCHECK(1) — a User Contributed Perl Documentation page, section 1 of the manual, no cap. It’s the tool that checks a DNSSEC-Tools keyrec file for problems and inconsistencies. Literally a vibe check for your keyrecs. 💅

✨ SYNOPSIS ✨

  krfcheck [-zone | -set | -key] [-count] [-quiet]
           [-verbose] [-Version] [-help] keyrec-file

🌸 DESCRIPTION 🌸

This script checks a keyrec file for problems, potential problems, and inconsistencies. Like, it is obsessed with finding the sketchy stuff. 🔥

🚨 Recognized problems include:

• no zones defined — the keyrec file does not contain any zone keyrecs.
• no sets defined — the keyrec file does not contain any set keyrecs.
• no keys defined — the keyrec file does not contain any key keyrecs.
• unknown zone keyrecs — a set keyrec or a key keyrec references a non-existent zone keyrec.
• missing key from zone keyrec — a zone keyrec does not have both a KSK key and a ZSK key.
• missing key from set keyrec — a key listed in a set keyrec does not have a key keyrec.
• expired zone keyrecs — a zone has expired. 😭
• mislabeled key — a key is labeled as a KSK (or ZSK) and its owner zone has it labeled as the opposite.
• invalid zone data values — a zone’s keyrec data are checked to ensure that they are valid. The following conditions are checked: existence of the zone file, existence of the KSK file, existence of the KSK and ZSK directories, the end-time is greater than one day, and the seconds-count and date string match.
• invalid key data values — a key’s keyrec data are checked to ensure that they are valid. The following conditions are checked: valid encryption algorithm, key length falls within algorithm’s size range, random generator file exists, and the seconds-count and date string match.

👀 Recognized potential problems include:

• imminent zone expiration — a zone will expire within one week.
• odd zone-signing date — a zone’s recorded signing date is later than the current system clock.
• orphaned keys — a key keyrec is unreferenced by any set keyrec.
• missing key directories — a zone keyrec’s key directories (kskdirectory or zskdirectory) does not exist.

🫠 Recognized inconsistencies include:

• key-specific fields in a zone keyrec — a zone keyrec contains key-specific entries. To allow for site-specific extensibility, krfcheck does not check for undefined keyrec fields.
• zone-specific fields in a key keyrec — a key keyrec contains zone-specific entries. To allow for site-specific extensibility, krfcheck does not check for undefined keyrec fields.
• mismatched zone timestamp — a zone’s seconds-count timestamp does not match its textual timestamp.
• mismatched set timestamp — a set’s seconds-count timestamp does not match its textual timestamp.
• mismatched key timestamp — a key’s seconds-count timestamp does not match its textual timestamp.

---

💅 OPTIONS 💅

• -zone — only perform checks of zone keyrecs. This option may not be combined with the -set or -key options.
• -set — only perform checks of set keyrecs. This option may not be combined with the -zone or -key options.
• -key — only perform checks of key keyrecs. This option may not be combined with the -set or -zone options.
• -count — display a final count of errors.
• -quiet — do not display messages. This option supersedes the setting of the -verbose option.
• -verbose — display many messages. This option is subordinate to the -quiet option.
• -Version — displays the version information for krfcheck and the DNSSEC-Tools package.
• -help — display a usage message.

💖 COPYRIGHT 💖

Copyright 2004-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details. 📜

🫶 AUTHOR 🫶

Wayne Morrison, tewok@tislabs.com.

👑 SEE ALSO 👑

• cleankrf(8)
• fixkrf(8)
• lskrf(1)
• zonesigner(8)
• Net::DNS::SEC::Tools::keyrec.pm(3)
• file-keyrec(5)

💖 That’s the whole manual page, bestie — this one’s from perl v5.44.0 and dated 2026-10-17. 🫶