342N/A<!
DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" 342N/A [<!ENTITY mdash "—">]>
342N/A - Copyright (C) 2008-2011 Internet Systems Consortium, Inc. ("ISC") 342N/A - Permission to use, copy, modify, and/or distribute this software for any 342N/A - purpose with or without fee is hereby granted, provided that the above 342N/A - copyright notice and this permission notice appear in all copies. 342N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 342N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 342N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 342N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 342N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 342N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 342N/A - PERFORMANCE OF THIS SOFTWARE. 342N/A <
date>August 26, 2009</
date>
1879N/A <
refentrytitle><
application>dnssec-dsfromkey</
application></
refentrytitle>
1879N/A <
refmiscinfo>BIND9</
refmiscinfo>
342N/A <
refname><
application>dnssec-dsfromkey</
application></
refname>
342N/A <
refpurpose>DNSSEC DS RR generation tool</
refpurpose>
342N/A <
holder>Internet Systems Consortium, Inc. ("ISC")</
holder>
342N/A <
command>dnssec-dsfromkey</
command>
342N/A <
arg><
option>-v <
replaceable class="parameter">level</
replaceable></
option></
arg>
342N/A <
arg><
option>-1</
option></
arg>
342N/A <
arg><
option>-2</
option></
arg>
342N/A <
arg><
option>-a <
replaceable class="parameter">alg</
replaceable></
option></
arg>
342N/A <
arg><
option>-l <
replaceable class="parameter">domain</
replaceable></
option></
arg>
342N/A <
arg choice="req">keyfile</
arg>
342N/A <
command>dnssec-dsfromkey</
command>
342N/A <
arg choice="req">-s</
arg>
342N/A <
arg><
option>-1</
option></
arg>
342N/A <
arg><
option>-2</
option></
arg>
342N/A <
arg><
option>-a <
replaceable class="parameter">alg</
replaceable></
option></
arg>
342N/A <
arg><
option>-K <
replaceable class="parameter">directory</
replaceable></
option></
arg>
342N/A <
arg><
option>-l <
replaceable class="parameter">domain</
replaceable></
option></
arg>
342N/A <
arg><
option>-s</
option></
arg>
342N/A <
arg><
option>-c <
replaceable class="parameter">class</
replaceable></
option></
arg>
342N/A <
arg><
option>-f <
replaceable class="parameter">file</
replaceable></
option></
arg>
342N/A <
arg><
option>-A</
option></
arg>
342N/A <
arg><
option>-v <
replaceable class="parameter">level</
replaceable></
option></
arg>
342N/A <
arg choice="req">dnsname</
arg>
441N/A <
title>DESCRIPTION</
title>
342N/A <
para><
command>dnssec-dsfromkey</
command>
342N/A outputs the Delegation Signer (DS) resource record (RR), as defined in
342N/A RFC 3658 and RFC 4509, for the given key(s).
2034N/A Use SHA-1 as the digest algorithm (the default is to use
342N/A Use SHA-256 as the digest algorithm.
1762N/A <
term>-a <
replaceable class="parameter">algorithm</
replaceable></
term>
1762N/A Select the digest algorithm. The value of
342N/A <
option>algorithm</
option> must be one of SHA-1 (SHA1),
342N/A SHA-256 (SHA256) or GOST. These values are case insensitive.
342N/A <
term>-K <
replaceable class="parameter">directory</
replaceable></
term>
342N/A Look for key files (or, in keyset mode,
342N/A <
filename>keyset-</
filename> files) in
1317N/A <
option>directory</
option>.
342N/A <
term>-f <
replaceable class="parameter">file</
replaceable></
term>
342N/A Zone file mode: in place of the keyfile name, the argument is
342N/A the DNS domain name of a zone master file, which can be read
342N/A from <
option>file</
option>. If the zone name is the same as
342N/A <
option>file</
option>, then it may be omitted.
342N/A If <
option>file</
option> is set to <
literal>"-"</
literal>, then
342N/A the zone data is read from the standard input. This makes it
342N/A possible to use the output of the <
command>dig</
command>
342N/A command as input, as in:
1111N/A Include ZSK's when generating DS records. Without this option,
1111N/A only keys which have the KSK flag set will be converted to DS
1111N/A records and printed. Useful only in zone file mode.
1111N/A <
term>-l <
replaceable class="parameter">domain</
replaceable></
term>
1111N/A Generate a DLV set instead of a DS set. The specified
1111N/A <
option>domain</
option> is appended to the name for each
1111N/A The DNSSEC Lookaside Validation (DLV) RR is described
1111N/A Keyset mode: in place of the keyfile name, the argument is
1111N/A the DNS domain name of a keyset file.
1111N/A <
term>-c <
replaceable class="parameter">class</
replaceable></
term>
1111N/A Specifies the DNS class (default is IN). Useful only
1111N/A in keyset or zone file mode.
342N/A <
term>-v <
replaceable class="parameter">level</
replaceable></
term>
342N/A Sets the debugging level.
342N/A To build the SHA-256 DS RR from the
342N/A keyfile name, the following command would be issued:
616N/A The command would print something like:
342N/A <
para><
userinput>
example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</
userinput>
342N/A The keyfile can be designed by the key identification
342N/A <
filename>Knnnn.+aaa+iiiii</
filename> or the full file name
342N/A <
refentrytitle>dnssec-keygen</
refentrytitle><
manvolnum>8</
manvolnum>.
342N/A The keyset file name is built from the <
option>directory</
option>,
342N/A the string <
filename>keyset-</
filename> and the
342N/A <
option>dnsname</
option>.
342N/A A keyfile error can give a "file not found" even if the file exists.
342N/A <
title>SEE ALSO</
title>
342N/A <
refentrytitle>dnssec-keygen</
refentrytitle><
manvolnum>8</
manvolnum>
342N/A <
refentrytitle>dnssec-signzone</
refentrytitle><
manvolnum>8</
manvolnum>
1111N/A <
citetitle>BIND 9 Administrator Reference Manual</
citetitle>,
616N/A <
citetitle>RFC 3658</
citetitle>,
342N/A <
citetitle>RFC 4431</
citetitle>.
1111N/A <
citetitle>RFC 4509</
citetitle>.
342N/A <
para><
corpauthor>Internet Systems Consortium</
corpauthor>