823N/A<!
DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" 823N/A [<!ENTITY mdash "—">]>
823N/A - Copyright (C) 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") 823N/A - Permission to use, copy, modify, and/or distribute this software for any 823N/A - purpose with or without fee is hereby granted, provided that the above 823N/A - copyright notice and this permission notice appear in all copies. 823N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 823N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 823N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 823N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 823N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 823N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 823N/A - PERFORMANCE OF THIS SOFTWARE. 823N/A <
date>May 02, 2012</
date>
823N/A <
refentrytitle><
application>dnssec-dsfromkey</
application></
refentrytitle>
823N/A <
manvolnum>8</
manvolnum>
823N/A <
refmiscinfo>BIND9</
refmiscinfo>
823N/A <
refname><
application>dnssec-dsfromkey</
application></
refname>
823N/A <
refpurpose>DNSSEC DS RR generation tool</
refpurpose>
823N/A <
holder>Internet Systems Consortium, Inc. ("ISC")</
holder>
823N/A <
command>dnssec-dsfromkey</
command>
823N/A <
arg><
option>-v <
replaceable class="parameter">level</
replaceable></
option></
arg>
823N/A <
arg><
option>-1</
option></
arg>
823N/A <
arg><
option>-2</
option></
arg>
823N/A <
arg><
option>-a <
replaceable class="parameter">alg</
replaceable></
option></
arg>
823N/A <
arg><
option>-C</
option></
arg>
823N/A <
arg><
option>-l <
replaceable class="parameter">domain</
replaceable></
option></
arg>
823N/A <
arg><
option>-T <
replaceable class="parameter">TTL</
replaceable></
option></
arg>
823N/A <
arg choice="req">keyfile</
arg>
823N/A <
command>dnssec-dsfromkey</
command>
823N/A <
arg choice="req">-s</
arg>
823N/A <
arg><
option>-1</
option></
arg>
823N/A <
arg><
option>-2</
option></
arg>
823N/A <
arg><
option>-a <
replaceable class="parameter">alg</
replaceable></
option></
arg>
823N/A <
arg><
option>-K <
replaceable class="parameter">directory</
replaceable></
option></
arg>
823N/A <
arg><
option>-l <
replaceable class="parameter">domain</
replaceable></
option></
arg>
823N/A <
arg><
option>-s</
option></
arg>
823N/A <
arg><
option>-c <
replaceable class="parameter">class</
replaceable></
option></
arg>
823N/A <
arg><
option>-T <
replaceable class="parameter">TTL</
replaceable></
option></
arg>
823N/A <
arg><
option>-f <
replaceable class="parameter">file</
replaceable></
option></
arg>
823N/A <
arg><
option>-A</
option></
arg>
823N/A <
arg><
option>-v <
replaceable class="parameter">level</
replaceable></
option></
arg>
823N/A <
arg choice="req">dnsname</
arg>
823N/A <
command>dnssec-dsfromkey</
command>
823N/A <
arg><
option>-h</
option></
arg>
823N/A <
arg><
option>-V</
option></
arg>
823N/A <
title>DESCRIPTION</
title>
823N/A <
para><
command>dnssec-dsfromkey</
command>
823N/A outputs the Delegation Signer (DS) resource record (RR), as defined in
823N/A RFC 3658 and RFC 4509, for the given key(s).
823N/A Use SHA-1 as the digest algorithm (the default is to use
823N/A both SHA-1 and SHA-256).
823N/A Use SHA-256 as the digest algorithm.
823N/A <
term>-a <
replaceable class="parameter">algorithm</
replaceable></
term>
823N/A Select the digest algorithm. The value of
823N/A <
option>algorithm</
option> must be one of SHA-1 (SHA1),
823N/A SHA-256 (SHA256), GOST or SHA-384 (SHA384).
823N/A These values are case insensitive.
823N/A Generate CDS records rather than DS records. This is mutually
823N/A exclusive with generating lookaside records.
823N/A <
term>-T <
replaceable class="parameter">TTL</
replaceable></
term>
823N/A Specifies the TTL of the DS records.
823N/A <
term>-K <
replaceable class="parameter">directory</
replaceable></
term>
823N/A Look for key files (or, in keyset mode,
823N/A <
filename>keyset-</
filename> files) in
823N/A <
option>directory</
option>.
823N/A <
term>-f <
replaceable class="parameter">file</
replaceable></
term>
823N/A Zone file mode: in place of the keyfile name, the argument is
823N/A the DNS domain name of a zone master file, which can be read
823N/A from <
option>file</
option>. If the zone name is the same as
823N/A <
option>file</
option>, then it may be omitted.
823N/A If <
option>file</
option> is set to <
literal>"-"</
literal>, then
823N/A the zone data is read from the standard input. This makes it
823N/A possible to use the output of the <
command>dig</
command>
823N/A command as input, as in:
823N/A Include ZSKs when generating DS records. Without this option,
823N/A only keys which have the KSK flag set will be converted to DS
823N/A records and printed. Useful only in zone file mode.
823N/A <
term>-l <
replaceable class="parameter">domain</
replaceable></
term>
823N/A Generate a DLV set instead of a DS set. The specified
823N/A <
option>domain</
option> is appended to the name for each
823N/A The DNSSEC Lookaside Validation (DLV) RR is described
823N/A in RFC 4431. This is mutually exclusive with generating
823N/A Keyset mode: in place of the keyfile name, the argument is
823N/A the DNS domain name of a keyset file.
<
term>-c <
replaceable class="parameter">class</
replaceable></
term>
Specifies the DNS class (default is IN). Useful only
in keyset or zone file mode.
<
term>-v <
replaceable class="parameter">level</
replaceable></
term>
Sets the debugging level.
Prints usage information.
Prints version information.
To build the SHA-256 DS RR from the
keyfile name, the following command would be issued:
<
para><
userinput>dnssec-dsfromkey -2
Kexample.com.+003+26160</
userinput>
The command would print something like:
<
para><
userinput>
example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</
userinput>
The keyfile can be designed by the key identification
<
filename>Knnnn.+aaa+iiiii</
filename> or the full file name
<
filename>Knnnn.+aaa+
iiiii.key</
filename> as generated by
<
refentrytitle>dnssec-keygen</
refentrytitle><
manvolnum>8</
manvolnum>.
The keyset file name is built from the <
option>directory</
option>,
the string <
filename>keyset-</
filename> and the
<
option>dnsname</
option>.
A keyfile error can give a "file not found" even if the file exists.
<
refentrytitle>dnssec-keygen</
refentrytitle><
manvolnum>8</
manvolnum>
<
refentrytitle>dnssec-signzone</
refentrytitle><
manvolnum>8</
manvolnum>
<
citetitle>BIND 9 Administrator Reference Manual</
citetitle>,
<
citetitle>RFC 3658</
citetitle>,
<
citetitle>RFC 4431</
citetitle>.
<
citetitle>RFC 4509</
citetitle>.
<
para><
corpauthor>Internet Systems Consortium</
corpauthor>