ROLLINIT(1)

📦 version 2.2.3, in arch rolling

💖 ROLLINIT(1) — the `rollinit` page, but make it make sense 💖

User Contributed Perl Documentation ✨ this is the manual for rollinit, bestie. buckle up.

🌸 NAME 🌸

rollinit — okay so what it does is create new rollrec records for a DNSSEC-Tools rollrec file. that's the whole vibe. 🎀

🦋 SYNOPSIS 🦋

rollinit [options] <zonename1> ... <zonenameN>

⭐ DESCRIPTION ⭐

So rollinit literally makes new rollrec entries for a rollrec file. and that rollrec file is the thing rollerd uses to manage key rollover for the zones you named. that's the pipeline, iykyk. 💅

The freshly generated rollrec entries go to standard output, unless you hit it with the -out option. standard output is the default, no cap.

A rollrec entry looks like this:

roll "example.com"
    zonename        "example.com"
    zonefile        "example.com.signed"
    keyrec          "example.com.krf"
    zonegroup       "example-zones"
    kskphase        "0"
    zskphase        "0"
    administrator   "bob@bobhost.example.com"
    directory       "/var/dns/zones/example.com"
    loglevel        "phase"
    ksk_rolldate    " "
    ksk_rollsecs    "0"
    zsk_rolldate    " "
    zsk_rollsecs    "0"
    maxttl          "604800"
    display         "1"
    phasestart      "Mon Jan 9 16:00:00 2006"
    # optional records for RFC5011 rolling:
    istrustanchor   "no"
    holddowntime    "60D"

The keywords roll and skip are what tell rollerd whether to process or ignore a particular rollrec entry. roll records are the default — they get created by default. but if you pass the -skip option, you get skip entries instead. switching teams fr fr.

The roll line has a name, and that name is what distinguishes it from every other rollrec entry in the file. The zonename field gets set to the name of the zone. these two are often the same, but — plot twist — that's not required. rollinit will set them to the same value, unless you use the -rollrec option. 👑

The zonefile and keyrec fields get set according to command-line options and arguments. and the way the actual values get generated is a little complex ngl — it's fully described down in the ZONEFILE And KEYREC FIELDS section below. 🫶

The zonegroup field is how you associate a set of rollrecs together, so a single rollctl -group command can control them as a unit. Multiple zonegroups may be specified in a comma-separated list. Leading and trailing whitespace gets deleted, but internal whitespace is allowed. This field is optional, and rollinit only sets it if you specify the -zonegroup option. (and yes, while this is using the term "zone", it's actually referring to the name of the rollrec entries. the more you know ✨)

The administrator field gets set to the email address of the person — or persons, if the address is actually a mailing list — considered to be the responsible person for the zone. main character of the zone, basically. 💌

The directory field gets set to the directory that contains the the files for the zone. yes, "the the". iconic. those files include the zone file, the signed zone file, and the keyrec file. 🍓

The loglevel field gets set to the level of log messages that rollerd should produce for this zone. important detail: the log level includes those messages at a greater priority to the specified level — so a level of "phase" will also include "err" and "fatal" messages. bundled deal, no separate checkout. 💜

The kskphase and zskphase fields indicate the rollover phase for the zone's KSK and ZSK keys. A value of 0 means the zone is in normal operation (non-rollover) for that key type. A non-zero phase (1-7 for KSKs; 1-4 for ZSKs) means the zone is in the process of rolling the keys. Only one of these fields should ever be non-zero at a particular time. If both are zero, then no rollover operations are taking place. simple as that. 🧚

The ksk_rolldate and ksk_rollsecs fields indicate when KSK rollover started. If the values are a blank and zero, respectively, then the zone is not in KSK rollover. that's the tell.

The zsk_rolldate and zsk_rollsecs fields indicate when ZSK rollover started. If the values are a blank and zero, respectively, then the zone is not in ZSK rollover. same energy, different key type. 🌈

The Boolean display field indicates if blinkenlights should display information about this zone. yes, blinkenlights. that's the actual name. 💀

The maxttl field contains the maximum TTL value from the zone file.

The phasestart fields contains the date that the current rollover phase was entered. 🗓️

rollrec files also have the zsargs field that holds user-specified options for zonesigner. This field is set during rollerd execution when the administrator determines that some zone fields should be modified. It is not an initial rollrec field, and consequently cannot be specified by rollinit. sorry bestie, not your field to touch. 🙈

The istrustanchor field specifies whether to roll the KSK keys in a manner compliant with any remote validating resolver using the KSK as a trust-anchor. If set to "yes", then 60 days will be the minimum wait time during phase 3 of KSK rolling, to ensure remote validators can properly follow the steps needed as specified by RFC5011. and the 60-day default can be changed via the holddowntime field. adjustable, slay. 🔥

👑 INFO ROLLRECS 👑

Starting with DNSSEC-Tools version 1.15, each rollrec file should have an info rollrec. This special rollrec entry contains information about the rollrec file itself and does not contain any zone information. Its contents should not be modified by anything but the DNSSEC-Tools utilities. hands off, it's not for you. 🚫

🎀 ZONEFILE and KEYREC FIELDS 🎀

The zonefile and keyrec fields may be given by using the -zonefile and -keyrec options, or default values may be used. pick your fighter. 💅

The default values use the rollrec's zone name, taken from the command line, as a base. .signed is appended to the zone name for the zone file; .krf is appended to the zone name for the keyrec file. automatic, no effort required. ✨

If -zonefile or -keyrec are specified, then the option values are used in one of two ways:

A single zone name is given on the command line. The option values for -zonefile and/or -keyrec are used for the actual rollrec fields.
Multiple zone names are given on the command line. The option values for -zonefile and/or -keyrec are used as templates for the actual rollrec fields. The option values must contain the string =. This string is replaced by the zone whose rollrec is being created.

See the EXAMPLES section for examples of how options are used by rollinit. (examples section is coming in part 2, don't come for me 🫶)

💜 OPTIONS 💜

rollinit may be given the following options:

-rollrec rollrec-name — This specifies the name of the rollrec record. This value may contain spaces. If this option is not specified, it will be set to the same value as the zonename field. See the ZONEFILE And KEYREC FIELDS and EXAMPLES sections for more details. 👑
-zonefile zonefile — This specifies the value of the zonefile field. See the ZONEFILE And KEYREC FIELDS and EXAMPLES sections for more details. 🎀
-keyrec keyrec-file — This specifies the value of the keyrec field. See the ZONEFILE And KEYREC FIELDS and EXAMPLES sections for more details. 🗂️
-zg zonegroup, -zonegroup zonegroup — This specifies the value of the zonegroup field. This field is optional. 🌸
-admin — This specifies the value of the administrator field. If it is not given, an administrator field will not be included for the record. 💌
-directory — This specifies the value of the directory field. If it is not given, a directory field will not be included for the record. 📁
-loglevel — This specifies the value of the loglevel field. If it is not given, a loglevel field will not be included for the record. 🪵
-skip — By default, roll records are generated. If this option is given, then skip records will be generated instead. plot twist ✨
-out output-file — The new rollrec entries will be appended to output-file. The file will be created if it does not exist. If this option is not given, the new rollrec entries will be written to standard output. 🖨️
-help — Display a usage message. 🆘
-Version — Display version information for rollinit and DNSSEC-Tools. ⭐

🧪 EXAMPLES 🧪

okay bestie, these examples are literally here to make it crystal clear how rollinit handles options and the new rollrecs. Example 1 gives you the complete new rollrec record. For brevity vibes, the rest of the examples only show the newly created zonefile and keyrec records.

An info rollrec shows up in the first example. To save space, it is not included in the remaining ones.

Example 1. One zone, no options

This is the rollrec you get by handing rollinit a single zone with zero options. Full record, main character energy:

           $ rollinit example.com

               skip    "info rollrec"
                   version         "2"

               roll    "example.com"
                   zonename        "example.com"
                   zonefile        "example.com.signed"
                   keyrec          "example.com.krf"
                   kskphase        "0"
                   zskphase        "0"
                   ksk_rolldate    " "
                   ksk_rollsecs    "0"
                   zsk_rolldate    " "
                   zsk_rollsecs    "0"
                   maxttl          "0"
                   display         "1"
                   phasestart      "new"

Example 2. One zone, -zonefile option

One zone, and we're passing the -zonefile option. Here's what gets generated:

           $ rollinit -zonefile signed-example example.com
               roll    "example.com"
                   zonename        "example.com"
                   zonefile        "signed-example"
                   keyrec          "example.com.krf"

Example 3. One zone, -keyrec option

One zone, but this time with the -keyrec option. Look at that keyrec field go:

           $ rollinit -keyrec x-rrf example.com
               roll    "example.com"
                   zonename        "example.com"
                   zonefile        "example.com.signed"
                   keyrec          "x-rrf"

Example 4. One zone, -zonefile and -keyrec options

One zone, both the -zonefile and -keyrec options in the mix. Slay:

           $ rollinit -zonefile signed-example -keyrec example.rrf example.com
               roll    "example.com"
                   zonename        "example.com"
                   zonefile        "signed-example"
                   keyrec          "example.rrf"

Example 5. One zone, -skip option

The original blurb for this one says it's showing the rollrec from the -zonefile and -keyrec options, and then the command itself is -skip — we're keeping the page's exact details, bestie. Here's the record:

           $ rollinit -skip example.com
               skip    "example.com"
                   zonename        "example.com"
                   zonefile        "example.com.signed"
                   keyrec          "example.com.krf"

Example 6. One zone, -rollrec option

One zone with the -rollrec option. The rollrec name becomes test, and the zone fields stay doing their thing:

           $ rollinit -rollrec test example.com
               roll    "test"
                   zonename        "example.com"
                   zonefile        "example.com.signed"
                   keyrec          "example.com.krf"

Example 7. Multiple zones, no options

Now we're giving it several zones with no options. Look at these two rollrecs side by side:

           $ rollinit example1.com example2.com
               roll    "example1.com"
                   zonename        "example1.com"
                   zonefile        "example1.com.signed"
                   keyrec          "example1.com.krf"

               roll    "example2.com"
                   zonename        "example2.com"
                   zonefile        "example2.com.signed"
                   keyrec          "example2.com.krf"

Example 8. Multiple zones, -zonefile option

Multiple zones plus the -zonefile option. The = template is doing its little substitution dance:

           $ rollinit -zonefile =-signed example1.com example2.com
               roll    "example1.com"
                   zonename        "example1.com"
                   zonefile        "example1.com-signed"
                   keyrec          "example1.com.krf"

               roll    "example2.com"
                   zonename        "example2.com"
                   zonefile        "example2.com-signed"
                   keyrec          "example2.com.krf"

Example 9. Multiple zones, -keyrec option

Multiple zones with the -keyrec option. The keyrec values get the template treatment too:

           $ rollinit -keyrec zone-=-keyrec example1.com example2.com
               roll    "example1.com"
                   zonename        "example1.com"
                   zonefile        "example1.com.signed"
                   keyrec          "zone-example1.com-keyrec"

               roll    "example2.com"
                   zonename        "example2.com"
                   zonefile        "example2.com.signed"
                   keyrec          "zone-example2.com-keyrec"

Example 10. Multiple zones, -zonefile and -keyrec options

Multiple zones, both -zonefile and -keyrec options. Templates everywhere, and the values are coming out exactly like this:

           $ rollinit -zonefile Z-= -keyrec =K example1.com example2.com
               roll    "example1.com"
                   zonename        "example1.com"
                   zonefile        "Z-example1.com"
                   keyrec          "example1.comK"

               roll    "example2.com"
                   zonename        "example2.com"
                   zonefile        "Z-example2.com"
                   keyrec          "example2.comK"

Example 11. Single zone, -zonefile and -keyrec options with template

One single zone, but the -zonefile and -keyrec options are using the multi-zone = template. Here's what that gives you:

           $ rollinit -zonefile Z-= -keyrec =.K example.com
               roll    "example.com"
                   zonename        "example.com"
                   zonefile        "Z-="
                   keyrec          "=.K"

This is probably not what is wanted, since it results in the zonefile and keyrec field values containing the =. Not the vibe you were going for, imo.

Example 12. Multiple zones, -zonefile and -keyrec options without template

Multiple zones with -zonefile and -keyrec, but no multi-zone = template. The options are just plain values:

           $ rollinit -zonefile ex.zone -keyrec ex.krf example1.com example2.com
               roll    "example1.com"
                   zonename        "example1.com"
                   zonefile        "ex.zone"
                   keyrec          "ex.krf"

               roll    "example2.com"
                   zonename        "example2.com"
                   zonefile        "ex.zone"
                   keyrec          "ex.krf"

This may not be what is wanted, since it results in the same zonefile and keyrec fields values for each rollrec. Same-value city, lowkey.

Example 13. Multiple zones, -rollrec option

Multiple zones with the -rollrec option, and the rollrec names include a space. Cute little = entry template moment:

           $ rollinit -rollrec "= entry" example1.com example2.com
               roll    "example1.com entry"
                   zonename        "example1.com"
                   zonefile        "example1.com.signed"
                   keyrec          "example1.com.krf"

               roll    "example2.com entry"
                   zonename        "example2.com"
                   zonefile        "example2.com.signed"
                   keyrec          "example2.com.krf"

Example 14. Multiple zones, -zg option

A set of zones with the -zg option. Both rollrecs get the same zonegroup value, and honestly? Iconic:

           $ rollinit -zg "example zones" example1.com example2.com
               roll    "example1.com"
                   zonename        "example1.com"
                   zonefile        "example1.com.signed"
                   keyrec          "example1.com.krf"
                   zonegroup       "example zones"

               roll    "example2.com"
                   zonename        "example2.com"
                   zonefile        "example2.com.signed"
                   keyrec          "example2.com.krf"
                   zonegroup       "example zones"

Example 15. One zone, Two zonegroups

One zone, and we're giving it a set of two zonegroups. The zonegroup field gets both, comma and all:

           $ rollinit -zg "customers, paid up" example.com
               roll    "example1.com"
                   zonename        "example.com"
                   zonefile        "example.com.signed"
                   keyrec          "example.com.krf"
                   zonegroup       "customers, paid up"

📜 COPYRIGHT 📜

👑 AUTHOR 👑

Wayne Morrison, tewok@tislabs.com

🌈 SEE ALSO 🌈

lsroll(1), rollerd(8), rollchk(8), zonesigner(8)
Net::DNS::SEC::Tools::keyrec.pm(3), Net::DNS::SEC::Tools::rollrec.pm(3)
file-keyrec.pm(5), file-rollrec.pm(5)

and that's the whole page, bestie 🫶 this icon is from perl v5.44.0, dated 2026-10-17 — go forth and roll those zones 💅✨

📦 where this page comes from

arch rolling: dnssec-tools 2.2.3-16 · BSD
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms