man.dnssec-signzone.html revision c2258eedf2d9d0207b45b90014f8fde5413b41a3
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater - Copyright (C) 2000-2015 Internet Systems Consortium, Inc. ("ISC")
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - This Source Code Form is subject to the terms of the Mozilla Public
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington - License, v. 2.0. If a copy of the MPL was not distributed with this
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington - file, You can obtain one at http://mozilla.org/MPL/2.0/.
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews<link rel="prev" href="man.dnssec-settime.html" title="dnssec-settime">
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<link rel="next" href="man.dnssec-verify.html" title="dnssec-verify">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center"><span class="application">dnssec-signzone</span></th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="man.dnssec-settime.html">Prev</a>�</td>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<th width="60%" align="center">Manual pages</th>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-verify.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="man.dnssec-signzone"></a><div class="titlepage"></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><span class="application">dnssec-signzone</span> — DNSSEC zone signing tool</p>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-M <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-Q</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><span class="command"><strong>dnssec-signzone</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signs a zone. It generates
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater NSEC and RRSIG records and produces a signed version of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone. The security status of delegations from the signed zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (that is, whether the child zones are secure or not) is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein determined by the presence or absence of a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">keyset</code> file for each child zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="variablelist"><dl class="variablelist">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Verify all generated signatures.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specifies the DNS class of the zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Compatibility mode: Generate a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">keyset-<em class="replaceable"><code>zonename</code></em></code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file in addition to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">dsset-<em class="replaceable"><code>zonename</code></em></code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when signing a zone, for use by older versions of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dnssec-signzone</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Look for <code class="filename">dsset-</code> or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">keyset-</code> files in <code class="option">directory</code>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Output only those record types automatically managed by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dnssec-signzone</strong></span>, i.e. RRSIG, NSEC,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NSEC3 and NSEC3PARAM records. If smart signing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (<code class="option">-S</code>) is used, DNSKEY records are also
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein included. The resulting file can be included in the original
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone file with <span class="command"><strong>$INCLUDE</strong></span>. This option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cannot be combined with <code class="option">-O raw</code>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">-O map</code>, or serial number updating.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When applicable, specifies the hardware to use for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cryptographic operations, such as a secure key store used
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for signing.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When BIND is built with OpenSSL PKCS#11 support, this defaults
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the string "pkcs11", which identifies an OpenSSL engine
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that can drive a cryptographic accelerator or hardware service
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein module. When BIND is built with native PKCS#11 cryptography
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (--enable-native-pkcs11), it defaults to the path of the PKCS#11
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews provider library specified via "--with-pkcs11".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Generate DS records for child zones from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">dsset-</code> or <code class="filename">keyset-</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file. Existing DS records will be removed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Key repository: Specify a directory to search for DNSSEC keys.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If not specified, defaults to the current directory.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Treat specified key as a key signing key ignoring any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key flags. This option may be specified multiple times.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Generate a DLV set in addition to the key (DNSKEY) and DS sets.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The domain is appended to the name of the records.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-M <em class="replaceable"><code>maxttl</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Sets the maximum TTL for the signed zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Any TTL higher than <em class="replaceable"><code>maxttl</code></em> in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein input zone will be reduced to <em class="replaceable"><code>maxttl</code></em>
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews in the output. This provides certainty as to the largest
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews possible TTL in the signed zone, which is useful to know when
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews rolling keys because it is the longest possible time before
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews signatures that have been retrieved by resolvers will expire
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews from resolver caches. Zones that are signed with this
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews option should be configured to use a matching
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews <code class="option">max-zone-ttl</code> in <code class="filename">named.conf</code>.
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews (Note: This option is incompatible with <code class="option">-D</code>,
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews because it modifies non-DNSSEC data in the output zone.)
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specify the date and time when the generated RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein become valid. This can be either an absolute or relative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time. An absolute start time is indicated by a number
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in YYYYMMDDHHMMSS notation; 20000530144500 denotes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 14:45:00 UTC on May 30th, 2000. A relative start time is
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews indicated by +N, which is N seconds from the current time.
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews If no <code class="option">start-time</code> is specified, the current
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time minus 1 hour (to allow for clock skew) is used.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specify the date and time when the generated RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein expire. As with <code class="option">start-time</code>, an absolute
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time is indicated in YYYYMMDDHHMMSS notation. A time relative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the start time is indicated with +N, which is N seconds from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the start time. A time relative to the current time is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein indicated with now+N. If no <code class="option">end-time</code> is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified, 30 days from the start time is used as a default.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">end-time</code> must be later than
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-X <em class="replaceable"><code>extended end-time</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specify the date and time when the generated RRSIG records
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews for the DNSKEY RRset will expire. This is to be used in cases
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews when the DNSKEY signatures need to persist longer than
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews signatures on other records; e.g., when the private component
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews of the KSK is kept offline and the KSK signature is to be
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews refreshed manually.
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews As with <code class="option">start-time</code>, an absolute
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews time is indicated in YYYYMMDDHHMMSS notation. A time relative
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews to the start time is indicated with +N, which is N seconds from
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews the start time. A time relative to the current time is
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews indicated with now+N. If no <code class="option">extended end-time</code> is
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews specified, the value of <code class="option">end-time</code> is used as
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews the default. (<code class="option">end-time</code>, in turn, defaults to
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews 30 days from the start time.) <code class="option">extended end-time</code>
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews must be later than <code class="option">start-time</code>.
52ece689e0265f9a3e518de5b2539e749f6d35acMark Andrews<dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The name of the output file containing the signed zone. The
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default is to append <code class="filename">.signed</code> to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the input filename. If <code class="option">output-file</code> is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein set to <code class="literal">"-"</code>, then the signed zone is
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews written to the standard output, with a default output
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews format of "full".
94fc951a9b5679def2a05387a5c251f5cb8eb9c9Mark Andrews Prints a short summary of the options and arguments to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>dnssec-signzone</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Prints version information.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When a previously-signed zone is passed as input, records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein may be resigned. The <code class="option">interval</code> option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specifies the cycle interval as an offset from the current
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time (in seconds). If a RRSIG record expires after the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cycle interval, it is retained. Otherwise, it is considered
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be expiring soon, and it will be replaced.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The default cycle interval is one quarter of the difference
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein between the signature end and start times. So if neither
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">end-time</code> or <code class="option">start-time</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are specified, <span class="command"><strong>dnssec-signzone</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signatures that are valid for 30 days, with a cycle
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein interval of 7.5 days. Therefore, if any existing RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are due to expire in less than 7.5 days, they would be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The format of the input zone file.
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater Possible formats are <span class="command"><strong>"text"</strong></span> (default),
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater <span class="command"><strong>"raw"</strong></span>, and <span class="command"><strong>"map"</strong></span>.
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater This option is primarily intended to be used for dynamic
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater signed zones so that the dumped zone file in a non-text
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater format containing updates can be signed directly.
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater The use of this option does not make much sense for
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater non-dynamic zones.
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater<dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt>
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater When signing a zone with a fixed signature lifetime, all
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater RRSIG records issued at the time of signing expires
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater simultaneously. If the zone is incrementally signed, i.e.
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater a previously-signed zone is passed as input to the signer,
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater all expired signatures have to be regenerated at about the
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater same time. The <code class="option">jitter</code> option specifies a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein jitter window that will be used to randomize the signature
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein expire time, thus spreading incremental signature
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein regeneration over time.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Signature lifetime jitter also to some extent benefits
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews validators and servers by spreading out cache expiration,
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews i.e. if large numbers of RRSIGs don't expire at the same time
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews from all caches there will be less congestion than if all
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews validators need to refetch at mostly the same time.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When writing a signed zone to "raw" or "map" format, set the
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater "source serial" value in the header to the specified serial
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein number. (This is expected to be used primarily for testing
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews<dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt>
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews Specifies the number of threads to use. By default, one
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews thread is started for each detected CPU.
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews<dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt>
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews The SOA serial number format of the signed zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Possible formats are <span class="command"><strong>"keep"</strong></span> (default),
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews <span class="command"><strong>"increment"</strong></span>, <span class="command"><strong>"unixtime"</strong></span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and <span class="command"><strong>"date"</strong></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="variablelist"><dl class="variablelist">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term"><span class="command"><strong>"keep"</strong></span></span></dt>
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews<dd><p>Do not modify the SOA serial number.</p></dd>
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews<dt><span class="term"><span class="command"><strong>"increment"</strong></span></span></dt>
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews<dd><p>Increment the SOA serial number using RFC 1982
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews<dt><span class="term"><span class="command"><strong>"unixtime"</strong></span></span></dt>
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews<dd><p>Set the SOA serial number to the number of seconds
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews<dt><span class="term"><span class="command"><strong>"date"</strong></span></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dd><p>Set the SOA serial number to today's date in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The zone origin. If not specified, the name of the zone file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is assumed to be the origin.
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater<dt><span class="term">-O <em class="replaceable"><code>output-format</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The format of the output file containing the signed zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Possible formats are <span class="command"><strong>"text"</strong></span> (default),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which is the standard textual representation of the zone;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>"full"</strong></span>, which is text output in a
and <span class="command"><strong>"map"</strong></span>, <span class="command"><strong>"raw"</strong></span>,
Kexample.com.+003+17247