DNSSEC-DSFROMKEY(8)

💅 DNSSEC-DSFROMKEY(8) 💅

okay so bestie, this is dnssec-dsfromkey, straight out of BIND 9 — it's the DNSSEC DS RR generation tool and it's literally the glow-up your keys need to get seen in the wild. 🦋

✨ NAME ✨

dnssec-dsfromkey — DNSSEC DS RR generation tool, no cap 💖

🎀 SYNOPSIS 🎀

dnssec-dsfromkey [ -1 | -2 | -a alg ] [ -C ] [-T TTL] [-v level] [-K
directory] {keyfile}

dnssec-dsfromkey [ -1 | -2 | -a alg ] [ -C ] [-T TTL] [-v level] [-c
class] [-A] {-f file} [dnsname]

dnssec-dsfromkey [ -1 | -2 | -a alg ] [ -C ] [-T TTL] [-v level] [-c
class] [-K directory] {-s} {dnsname}

dnssec-dsfromkey [ -h | -V ]

🌸 DESCRIPTION 🌸

The dnssec-dsfromkey command outputs DS (Delegation Signer) resource records (RRs) — and if you pass the -C option, it gives you CDS (Child DS) RRs instead. Two lewks, one tool. ✨

By default, only KSKs get converted (those are the keys with flags = 257). If you want the ZSKs in on the fun too (flags = 256), that's what the -A option is for. And revoked keys? Never included. Not on the list, not invited, blocked. 💀

The input keys can be specified in a number of ways:

• By default, dnssec-dsfromkey reads a key file named in the format Knnnn.+aaa+iiiii.key, as generated by dnssec-keygen. iconic naming convention fr.
• With the -f file option, dnssec-dsfromkey reads keys from a zone file or partial zone file (which can contain just the DNSKEY records). lowkey flexible.
• With the -s option, dnssec-dsfromkey reads a keyset- file, as generated by dnssec-keygen -C.

💅 OPTIONS 💅

• -1 — this option is an abbreviation for -a SHA1. short & sweet.
• -2 — this option is an abbreviation for -a SHA-256. also short & sweet.
• -a algorithm — this option specifies a digest algorithm to use when converting DNSKEY records to DS records. This option can be repeated, so that multiple DS records are created for each DNSKEY record. (yes bestie, stack them! 🫶)

The algorithm must be one of SHA-1, SHA-256, or SHA-384. These values are case-insensitive, and the hyphen may be omitted. If no algorithm is specified, the default is SHA-256. periodt.

• -A — this option indicates that ZSKs are to be included when generating DS records. Without this option, only keys which have the KSK flag set are converted to DS records and printed. This option is only useful in -f zone file mode. ⭐
• -c class — this option specifies the DNS class; the default is IN. This option is only useful in -s keyset or -f zone file mode.
• -C — this option generates CDS records rather than DS records. the plot twist nobody saw coming. 😭
• -f file — this option sets zone file mode, in which the final dnsname argument of dnssec-dsfromkey is the DNS domain name of a zone whose master file can be read from file. If the zone name is the same as file, then it may be omitted. convenient!

If file is -, then the zone data is read from the standard input. This makes it possible to use the output of the dig command as input, as in:

dig dnskey example.com | dnssec-dsfromkey -f - example.com

piped and slaying. 🔥

• -h — this option prints usage information. the classic cry for help.
• -K directory — this option tells BIND 9 to look for key files or keyset- files in directory. go find them bestie 🧚
• -s — this option enables keyset mode, in which the final dnsname argument from dnssec-dsfromkey is the DNS domain name used to locate a keyset- file.
• -T TTL — this option specifies the TTL of the DS records. By default the TTL is omitted. (omitted is a valid aesthetic 💜)
• -v level — this option sets the debugging level. for when you need to know everything.
• -V — this option prints version information.

---

🌈 EXAMPLE 🌈

To build the SHA-256 DS RR from the Kexample.com.+003+26160 keyfile, issue the following command:

dnssec-dsfromkey -2 Kexample.com.+003+26160

The command returns something similar to:

example.com. IN DS 26160 5 2
3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94

ate. no crumbs. 👑

🍓 FILES 🍓

The keyfile can be designated by the key identification Knnnn.+aaa+iiiii or the full file name Knnnn.+aaa+iiiii.key, as generated by dnssec-keygen.

The keyset file name is built from the directory, the string keyset-, and the dnsname.

💀 CAVEAT 💀

A keyfile error may return "file not found," even if the file exists. bestie the file is RIGHT THERE and it's being dramatic. 🙈

🌟 SEE ALSO 🌟

dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 3658 (DS RRs), RFC 4509 (SHA-256 for DS RRs), RFC 6605 (SHA-384 for DS RRs), RFC 7344 (CDS and CDNSKEY RRs).

💖 AUTHOR 💖

Internet Systems Consortium

🦋 COPYRIGHT 🦋

2024, Internet Systems Consortium

---

and that's the whole vibe check, bestie — this page is from 9.16.50-RH (the 9.16.50-RH build, dated with that 2024 copyright from Internet Systems Consortium, home of BIND 9), and it said everything it needed to say. mwah. 💅✨🎀