opendkim-genzone(8)

💅 NAME 💅

opendkim-genzone — the DKIM public key zone file generation tool, and yes bestie it does exactly what it says on the tin ✨

So this page? It's from the opendkim-genzone(8) corner of the System Manager's Manual, and it's about to be your new fave. Let's go 🎀

---

🌸 SYNOPSIS 🌸

opendkim-genzone [-C address] [-d domain] [-D] [-E secs] [-F] [-N
ns[,...]]  [-o file] [-r secs] [-R secs] [-s] [-S] [-t secs] [-T secs]
[-u] [-v] [-x conffile] [dataset]

Like, look at all those flags. She's got range 💅

---

🦋 DESCRIPTION 🦋

okay so opendkim-genzone generates a file that's suitable for use with named(8) so you can publish a whole set of public keys. It's giving "here's your zone file, go be iconic" ✨

The dataset parameter should specify a set of data as described in the opendkim(8) man page. rn it can refer to flat files, Sleepycat databases, comma-separated lists, LDAP directories, or SQL databases — so many vibes, all valid 🫶

You can literally omit the dataset if you specify a configuration file (via the -x command line flag) that refers to a config file setting a KeyTable parameter — in that case, that value gets used instead. Convenient? Extremely. 😌

The database contents should be formatted as described for the KeyTable parameter, which is described in the opendkim.conf(5) man page. iykyk 📖

---

✨ OPTIONS ✨

• -C contact — Uses contact as the contact information when an SOA record gets generated (peep -S below 👀). If you don't specify it, the userid of the executing user plus the local hostname get used; and if the executing user can't be determined, "hostmaster" is used instead. fallback queen 💖
• -d domain — Restricts output to only those records where the domain field is the specified domain. filter that feed bestie 🎀
• -D — Adds a "._domainkey" suffix to selector names in the zone file. cute lil suffix, no cap 💅
• -E secs — When generating an SOA record (see -S below), use secs as the default record expiration time. The default is 604800. ⏳
• -F — Adds a "._domainkey" suffix and the domainname to selector names in the zone file. she does the most, and we love her for it 💖
• -N nslist — Specifies a comma-separated list of nameservers, which get output in NS records before the TXT records. The first nameserver in this list is also used in the SOA record (if -S is also specified) as the authority hostname. main character nameserver energy 👑
• -o file — Sends output to the named file instead of standard output. file it away bestie 🗂️
• -r secs — When generating an SOA record (see -S below), use secs as the zone refresh time. The default is 10800. 🔄
• -R secs — When generating an SOA record (see -S below), use secs as the zone retry time. The default is 1800. 🔁
• -s — Extends the logic of "-d" to include subdomains. she goes deeper 💀
• -S — Asks for an SOA record to be generated at the top of the output. The content of this output can be controlled using the -E, -r, -R, and -T options. The serial number gets generated based on the current time of day. clock-based serial, iconic behavior ⏰
• -t ttl — Puts a TTL (time-to-live) value of ttl on all records output. The units are in seconds. ⏱️
• -T secs — When generating an SOA record (see -S below), use secs as the default record TTL time. The default is 86400. 🕐
• -u — Produces output suitable for use as input to nsupdate(8). pipeline realness 🔥
• -v — Increases the verbosity of debugging output written to standard error. give me the tea ☕
• -x conffile — Names an opendkim.conf(5) file to be read for LDAP-specific parameters when an LDAP dataset is given on the command line. Not required for other dataset types. The default is /etc/opendkim/opendkim.conf. default path slay 🎀

---

🌈 VERSION 🌈

This man page covers the version of opendkim-genzone that shipped with version 2.11.0 of OpenDKIM. periodt 💜

---

🧚 COPYRIGHT 🧚

Copyright (c) 2010, 2012, 2014, 2015, The Trusted Domain Project. All rights reserved. 🫶

---

⭐ SEE ALSO ⭐

nsupdate(8), opendkim(8), opendkim.conf(5) — go read these next, bestie, they're all part of the lore 📚

---

okay that's the whole page, no detail left behind, we ate and left no crumbs 💅✨

🌸 big kiss from The Trusted Domain Project — this was opendkim-genzone(8) from version 2.11.0, mwah 🎀💖