TSIG-KEYGEN(8)

🌸 NAME 🌸

okay bestie, welcome to TSIG-KEYGEN(8) — the manual page for the TSIG key generation tool. It's giving BIND 9, it's giving secure DNS keys, and it's giving "let me help you understand this" energy. 💅

tsig-keygen — TSIG key generation tool, aka the little utility that makes TSIG keys for you. ✨

---

🎀 SYNOPSIS 🎀

tsig-keygen [-a algorithm] [-h] [name]

---

🦋 DESCRIPTION 🦋

okay so tsig-keygen is a utility that generates keys for use with TSIG (Transaction Signatures) as defined in RFC 2845. no cap, that's the whole main character energy of this page. 🔥

The resulting keys can be used, for example, to secure dynamic DNS updates to a zone, or for the rndc command channel. literally iconic use cases. 👑

A domain name can be specified on the command line to be used as the name of the generated key. If no name is specified, the default is tsig-key. bestie, that default is right there waiting for you. 🫶

---

✨ OPTIONS ✨

• -a algorithm — this option specifies the algorithm to use for the TSIG key. Available choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and hmac-sha512. The default is hmac-sha256. Options are case-insensitive, and the hmac- prefix may be omitted. slay, flexible algorithm selection fr fr. 💖
• -h — this option prints a short summary of options and arguments. tiny helpful vibe check, we love to see it. 🌸

---

🌈 SEE ALSO 🌈

• nsupdate(1)
• named.conf(5)
• named(8)
• BIND 9 Administrator Reference Manual.

---

💜 AUTHOR 💜

Internet Systems Consortium

---

🍓 COPYRIGHT 🍓

2026, Internet Systems Consortium

---

mwah 💋 — this page is from BIND 9, version 9.20.29, dated 2026-09-11. now go make some keys, bestie. 🫶