RNDC-CONFGEN(8)

🌸 RNDC-CONFGEN(8) — the rndc key generation tool, bestie edition 🌸

okay so you're reading the rndc-confgen page from BIND 9 — yes that BIND 9, the DNS one. Sit down, grab a strawberry 🍓, we're gonna make keys together.

---

✨ NAME ✨

rndc-confgen — literally the rndc key generation tool. that's the whole vibe. it makes keys, it makes config. icon behavior.

---

🎀 SYNOPSIS 🎀

rndc-confgen [-a] [-A algorithm] [-b keysize] [-c keyfile] [-h] [-k
keyname] [-p port] [-s address] [-t chrootdir] [-u user]

no subcommands, no drama. just flags. slay 💅

---

🦋 DESCRIPTION 🦋

So rndc-confgen generates configuration files for rndc. Think of it as the glow-up shortcut — instead of hand-writing the rndc.conf file and the matching controls and key statements in named.conf all by yourself (huge effort, lowkey exhausting), you just let this little icon do it.

OR — and this is the fun part — you can run it with the -a option and it'll set up a rndc.key file, which means you don't need a rndc.conf file or a controls statement at all. no cap, it's that easy. ✨

---

💖 OPTIONS 💖

• -a — this one sets up automatic rndc configuration. it creates a file at /etc/bind/rndc.key that gets read by both rndc and named on startup. that rndc.key file defines a default command channel and authentication key, so rndc can talk to named on the local host with zero further configuration. main character energy honestly.

but bestie, listen: if you need a fancier setup than what rndc-confgen -a gives you — say, if rndc is gonna be used remotely — run rndc-confgen without -a and set up rndc.conf and named.conf as directed. don't skip this. 🙈

• -A algorithm — picks the algorithm for the TSIG key. your choices are, alphabetically and also iconically: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and hmac-sha512. the default is hmac-sha256. she's the default for a reason 💜
• -b keysize — the size of the authentication key, in bits. it has to be between 1 and 512 bits, and the default is the hash size. tiny keys exist but like… why.
• -c keyfile — used with -a to specify an alternate location for rndc.key. basically "not that folder, this folder." 🎀
• -h — prints a short summary of the options and arguments to rndc-confgen. the little "help me help you" flag.
• -k keyname — the key name of the rndc authentication key. it must be a valid domain name, and it will be sanitized using the domain name semantics. the default is rndc-key. don't try to be cute with invalid names, she will fix them for you.
• -p port — the command channel port where named listens for connections from rndc. default is 953. classic.
• -q — prevents printing the written path in automatic configuration mode. quiet queen behavior, she just does the thing and doesn't announce it 🤫
• -s address — the IP address where named listens for command-channel connections from rndc. default is the loopback address 127.0.0.1. home sweet home.
• -t chrootdir — used with -a to specify a directory where named runs chrooted. an additional copy of the rndc.key gets written relative to this directory, so the chrooted named can actually find it. one key, two homes, both valid 🫶
• -u user — used with -a to set the owner of the generated rndc.key file. heads up though: if -t is also specified, only the file in the chroot area has its owner changed. noted. ⭐

---

🌈 EXAMPLES 🌈

Wanna let rndc work with absolutely zero manual configuration? run:

rndc-confgen -a

And if you want a sample rndc.conf file printed out, plus the corresponding controls and key statements to manually paste into named.conf, run:

rndc-confgen

that's it. that's the whole ritual. 🔥

---

👑 SEE ALSO 👑

• rndc(8)
• rndc.conf(5)
• named(8)
• BIND 9 Administrator Reference Manual.

go read those too, iykyk 💅

---

🧚 Author 🧚

Internet Systems Consortium

💜 Copyright 💜

2026, Internet Systems Consortium

---

okay bestie that's the whole page, you're officially a rndc-confgen girlie now 💖 This was BIND 9 version 9.20.30, dated 2026-10-12 — go forth and generate those keys, periodt. 🎀✨