man.dnssec-signzone.html revision 97e74139b19368e385a3564746d42db70879195e
1fdd2470b625a58b57d0b155e6caf8c4fc0afe8aAutomatic Updater - Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Permission to use, copy, modify, and/or distribute this software for any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater<!-- $Id: man.dnssec-signzone.html,v 1.211 2011/12/22 18:10:10 tbox Exp $ -->
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="man.dnssec-settime.html" title="dnssec-settime">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="man.named-checkconf.html" title="named-checkconf">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<tr><th colspan="3" align="center"><span class="application">dnssec-signzone</span></th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="man.dnssec-settime.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="man.dnssec-signzone"></a><div class="titlepage"></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><span class="application">dnssec-signzone</span> — DNSSEC zone signing tool</p>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><span><strong class="command">dnssec-signzone</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signs a zone. It generates
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NSEC and RRSIG records and produces a signed version of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone. The security status of delegations from the signed zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (that is, whether the child zones are secure or not) is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein determined by the presence or absence of a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">keyset</code> file for each child zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Verify all generated signatures.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specifies the DNS class of the zone.
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews Compatibility mode: Generate a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">keyset-<em class="replaceable"><code>zonename</code></em></code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file in addition to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">dsset-<em class="replaceable"><code>zonename</code></em></code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when signing a zone, for use by older versions of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">dnssec-signzone</strong></span>.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Look for <code class="filename">dsset-</code> or
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <code class="filename">keyset-</code> files in <code class="option">directory</code>.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce Output only those record types automatically managed by
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span><strong class="command">dnssec-signzone</strong></span>, i.e. RRSIG, NSEC,
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce NSEC3 and NSEC3PARAM records. If smart signing
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce (<code class="option">-S</code>) is used, DNSKEY records are also
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce included. The resulting file can be included in the original
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce zone file with <span><strong class="command">$INCLUDE</strong></span>. This option
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce cannot be combined with <code class="option">-O raw</code> or serial
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce number updating.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews Uses a crypto hardware (OpenSSL engine) for the crypto operations
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce it supports, for instance signing with private keys from
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce a secure key store. When compiled with PKCS#11 support
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce it defaults to pkcs11; the empty name resets it to no engine.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Generate DS records for child zones from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">dsset-</code> or <code class="filename">keyset-</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file. Existing DS records will be removed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Key repository: Specify a directory to search for DNSSEC keys.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews If not specified, defaults to the current directory.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Treat specified key as a key signing key ignoring any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key flags. This option may be specified multiple times.
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Generate a DLV set in addition to the key (DNSKEY) and DS sets.
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater The domain is appended to the name of the records.
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater Specify the date and time when the generated RRSIG records
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater become valid. This can be either an absolute or relative
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater time. An absolute start time is indicated by a number
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in YYYYMMDDHHMMSS notation; 20000530144500 denotes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 14:45:00 UTC on May 30th, 2000. A relative start time is
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews indicated by +N, which is N seconds from the current time.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If no <code class="option">start-time</code> is specified, the current
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time minus 1 hour (to allow for clock skew) is used.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specify the date and time when the generated RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein expire. As with <code class="option">start-time</code>, an absolute
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time is indicated in YYYYMMDDHHMMSS notation. A time relative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the start time is indicated with +N, which is N seconds from
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater the start time. A time relative to the current time is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein indicated with now+N. If no <code class="option">end-time</code> is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified, 30 days from the start time is used as a default.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">end-time</code> must be later than
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews<dt><span class="term">-X <em class="replaceable"><code>extended end-time</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specify the date and time when the generated RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for the DNSKEY RRset will expire. This is to be used in cases
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews when the DNSKEY signatures need to persist longer than
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews signatures on other records; e.g., when the private component
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of the KSK is kept offline and the KSK signature is to be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein refreshed manually.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein As with <code class="option">start-time</code>, an absolute
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time is indicated in YYYYMMDDHHMMSS notation. A time relative
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews to the start time is indicated with +N, which is N seconds from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the start time. A time relative to the current time is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein indicated with now+N. If no <code class="option">extended end-time</code> is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified, the value of <code class="option">end-time</code> is used as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the default. (<code class="option">end-time</code>, in turn, defaults to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 30 days from the start time.) <code class="option">extended end-time</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein must be later than <code class="option">start-time</code>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The name of the output file containing the signed zone. The
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default is to append <code class="filename">.signed</code> to
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater the input filename. If <code class="option">output-file</code> is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein set to <code class="literal">"-"</code>, then the signed zone is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein written to the standard output, with a default output
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein format of "full".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Prints a short summary of the options and arguments to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">dnssec-signzone</strong></span>.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews When a previously-signed zone is passed as input, records
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews may be resigned. The <code class="option">interval</code> option
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews specifies the cycle interval as an offset from the current
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews time (in seconds). If a RRSIG record expires after the
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews cycle interval, it is retained. Otherwise, it is considered
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be expiring soon, and it will be replaced.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The default cycle interval is one quarter of the difference
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein between the signature end and start times. So if neither
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">end-time</code> or <code class="option">start-time</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are specified, <span><strong class="command">dnssec-signzone</strong></span>
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews signatures that are valid for 30 days, with a cycle
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein interval of 7.5 days. Therefore, if any existing RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are due to expire in less than 7.5 days, they would be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The format of the input zone file.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Possible formats are <span><strong class="command">"text"</strong></span> (default)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and <span><strong class="command">"raw"</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This option is primarily intended to be used for dynamic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signed zones so that the dumped zone file in a non-text
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein format containing updates can be signed directly.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The use of this option does not make much sense for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein non-dynamic zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When signing a zone with a fixed signature lifetime, all
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RRSIG records issued at the time of signing expires
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein simultaneously. If the zone is incrementally signed, i.e.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a previously-signed zone is passed as input to the signer,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein all expired signatures have to be regenerated at about the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein same time. The <code class="option">jitter</code> option specifies a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein jitter window that will be used to randomize the signature
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews expire time, thus spreading incremental signature
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein regeneration over time.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Signature lifetime jitter also to some extent benefits
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validators and servers by spreading out cache expiration,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein i.e. if large numbers of RRSIGs don't expire at the same time
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from all caches there will be less congestion than if all
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validators need to refetch at mostly the same time.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When writing a signed zone to 'raw' format, set the "source serial"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein value in the header to the specified serial number. (This is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein expected to be used primarily for testing purposes.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specifies the number of threads to use. By default, one
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews thread is started for each detected CPU.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The SOA serial number format of the signed zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Possible formats are <span><strong class="command">"keep"</strong></span> (default),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">"increment"</strong></span> and
and <span><strong class="command">"raw"</strong></span> or <span><strong class="command">"raw=N"</strong></span>,
by <span><strong class="command">named</strong></span>. <span><strong class="command">"raw=N"</strong></span>
Kexample.com.+003+17247