dnssec-signzone.html revision 841179549b6433e782c164a562eb3422f603533d
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - Copyright (C) 2000, 2001 Internet Software Consortium.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - Permission to use, copy, modify, and distribute this software for any
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - purpose with or without fee is hereby granted, provided that the above
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - copyright notice and this permission notice appear in all copies.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews<!-- $Id: dnssec-signzone.html,v 1.3 2001/06/08 19:31:32 gson Exp $ -->
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-signzone</TITLE
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsNAME="GENERATOR"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCONTENT="Modular DocBook HTML Stylesheet Version 1.61
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REFENTRY"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsBGCOLOR="#FFFFFF"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsTEXT="#000000"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsLINK="#0000FF"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsVLINK="#840084"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsALINK="#0000FF"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="APPLICATION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-signzone</SPAN
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REFNAMEDIV"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="APPLICATION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-signzone</SPAN
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> -- DNSSEC zone signing tool</DIV
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REFSYNOPSISDIV"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>Synopsis</H2
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="COMMAND"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-signzone</B
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt>directory</I
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>start-time</I
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>output-file</I
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>randomdev</I
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>] {zonefile} [key...]</P
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan HuntCLASS="REFSECT1"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>DESCRIPTION</H2
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="COMMAND"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-signzone</B
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt> signs a zone. It generates NXT
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt and SIG records and produces a signed version of the zone. If there
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan HuntCLASS="FILENAME"
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt>signedkey</TT
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt> file from the zone's parent,
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt the parent's signatures will be incorporated into the generated
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt signed zone file. The security status of delegations from the the
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt signed zone (that is, whether the child zones are secure or not) is
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt determined by the presence or absence of a
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan HuntCLASS="FILENAME"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>signedkey</TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> file for each child zone.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REFSECT1"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="VARIABLELIST"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> Verify all generated signatures.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> Specifies the DNS class of the zone.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>directory</I
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> Look for <TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="FILENAME"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>signedkey</TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>directory</TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> as the directory
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>start-time</I
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> Specify the date and time when the generated SIG records
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews become valid. This can be either an absolute or relative
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews time. An absolute start time is indicated by a number
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews in YYYYMMDDHHMMSS notation; 20000530144500 denotes
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews 14:45:00 UTC on May 30th, 2000. A relative start time is
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews indicated by +N, which is N seconds from the current time.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>start-time</TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> is specified, the current
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews time is used.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> Specify the date and time when the generated SIG records
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews expire. As with <TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>start-time</TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>, an absolute
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews time is indicated in YYYYMMDDHHMMSS notation. A time relative
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews to the start time is indicated with +N, which is N seconds from
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the start time. A time realtive to the current time is
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews indicated with now+N. If no <TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>end-time</TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews specified, 30 days from the start time is used as a default.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>output-file</I
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> The name of the output file containing the signed zone. The
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews default is to append <TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="FILENAME"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> Prints a short summary of the options and arguments to
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="COMMAND"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-signzone</B
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> When a previously signed zone is passed as input, records
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews may be resigned. The <TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="OPTION"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>interval</TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews specifies the cycle interval as an offset from the current
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews time (in seconds). If a SIG record expires after the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews cycle interval, it is retained. Otherwise, it is considered
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt to be expiring soon, and it will be replaced.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt> The default cycle interval is one quarter of the difference
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt between the signature end and start times. So if neither
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan HuntCLASS="OPTION"
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt>end-time</TT
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan HuntCLASS="OPTION"
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt>start-time</TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews are specified, <B
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="COMMAND"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-signzone</B
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews signatures that are valid for 30 days, with a cycle
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews interval of 7.5 days. Therefore, if any existing SIG records
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews are due to expire in less than 7.5 days, they would be
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> Specifies the number of threads to use. By default, one
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews thread is started for each detected CPU.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt> The zone origin. If not specified, the name of the zone file
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews is assumed to be the origin.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> Use pseudo-random data when signing the zone. This is faster,
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews but less secure, than using real random data. This option
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews may be useful when signing large zones or when the entropy
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews source is limited.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan HuntCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>randomdev</I
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> Specifies the source of randomness. If the operating
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews system does not provide a <TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="FILENAME"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews or equivalent device, the default source of randomness
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews is keyboard input. <TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="FILENAME"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>randomdev</TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the name of a character device or file containing random
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews data to be used instead of the default. The special value
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="FILENAME"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>keyboard</TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> indicates that keyboard
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews input should be used.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> Print statistics at completion.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REPLACEABLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> Sets the debugging level.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>zonefile</DT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> The file containing the zone to be signed.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews Sets the debugging level.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> The keys used to sign the zone. If no keys are specified, the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews default all zone keys that have private key files in the
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews current directory.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan HuntCLASS="REFSECT1"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsNAME="AEN154"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> The following command signs the <TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="USERINPUT"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews zone with the DSA key generated in the <B
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="COMMAND"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-keygen</B
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews man page. The zone's keys must be in the zone. If there are
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="FILENAME"
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt>signedkey</TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> files associated with this zone
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews or any child zones, they must be in the current directory.
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="USERINPUT"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>, the following command would be
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="USERINPUT"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-signzone -o example.com db.example.com Kexample.com.+003+26160</B
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> The command would print a string of the form:
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews> In this example, <B
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="COMMAND"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-signzone</B
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews the file <TT
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="FILENAME"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews should be referenced in a zone statement in a
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="FILENAME"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REFSECT1"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsNAME="AEN168"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>SEE ALSO</H2
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="CITEREFENTRY"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REFENTRYTITLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-keygen</SPAN
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="CITEREFENTRY"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REFENTRYTITLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>dnssec-signkey</SPAN
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="CITETITLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark Andrews>BIND 9 Administrator Reference Manual</I
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="CITETITLE"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsCLASS="REFSECT1"
c3c8823fed039b3a2b8e5ca8bc2f3301d1dd840eMark AndrewsNAME="AEN179"
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt> Internet Software Consortium