man.dnssec-signzone.html revision fa535fa05f36a1a45027faf9d116cfa3249d9d72
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - Copyright (C) 2000-2003 Internet Software Consortium.
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - Permission to use, copy, modify, and/or distribute this software for any
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - purpose with or without fee is hereby granted, provided that the above
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - copyright notice and this permission notice appear in all copies.
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - PERFORMANCE OF THIS SOFTWARE.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<!-- $Id$ -->
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley<link rel="prev" href="man.dnssec-settime.html" title="dnssec-settime">
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley<link rel="next" href="man.dnssec-verify.html" title="dnssec-verify">
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley<tr><th colspan="3" align="center"><span class="application">dnssec-signzone</span></th></tr>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<a accesskey="p" href="man.dnssec-settime.html">Prev</a>�</td>
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-verify.html">Next</a>
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley<a name="man.dnssec-signzone"></a><div class="titlepage"></div>
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley<p><span class="application">dnssec-signzone</span> — DNSSEC zone signing tool</p>
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-M <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-Q</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley<p><span><strong class="command">dnssec-signzone</strong></span>
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley signs a zone. It generates
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley NSEC and RRSIG records and produces a signed version of the
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley zone. The security status of delegations from the signed zone
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley (that is, whether the child zones are secure or not) is
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley determined by the presence or absence of a
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley <code class="filename">keyset</code> file for each child zone.
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley Verify all generated signatures.
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley Specifies the DNS class of the zone.
3740b569ae76295b941d57a724a43beb75b533baBob Halley Compatibility mode: Generate a
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley <code class="filename">keyset-<em class="replaceable"><code>zonename</code></em></code>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley file in addition to
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley <code class="filename">dsset-<em class="replaceable"><code>zonename</code></em></code>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley when signing a zone, for use by older versions of
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley <span><strong class="command">dnssec-signzone</strong></span>.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley <code class="filename">keyset-</code> files in <code class="option">directory</code>.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley Output only those record types automatically managed by
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley <span><strong class="command">dnssec-signzone</strong></span>, i.e. RRSIG, NSEC,
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley NSEC3 and NSEC3PARAM records. If smart signing
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley (<code class="option">-S</code>) is used, DNSKEY records are also
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley included. The resulting file can be included in the original
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley zone file with <span><strong class="command">$INCLUDE</strong></span>. This option
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley cannot be combined with <code class="option">-O raw</code>,
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley <code class="option">-O map</code>, or serial number updating.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
3740b569ae76295b941d57a724a43beb75b533baBob Halley When applicable, specifies the hardware to use for
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley cryptographic operations, such as a secure key store used
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley for signing.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley When BIND is built with OpenSSL PKCS#11 support, this defaults
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley to the string "pkcs11", which identifies an OpenSSL engine
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley that can drive a cryptographic accelerator or hardware service
08dbab20efc74209b611bf543e0e9a2743aca84aBob Halley module. When BIND is built with native PKCS#11 cryptography
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley (--enable-native-pkcs11), it defaults to the path of the PKCS#11
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley provider library specified via "--with-pkcs11".
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley Generate DS records for child zones from
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley <code class="filename">dsset-</code> or <code class="filename">keyset-</code>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley file. Existing DS records will be removed.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley Key repository: Specify a directory to search for DNSSEC keys.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley If not specified, defaults to the current directory.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt>
3740b569ae76295b941d57a724a43beb75b533baBob Halley Treat specified key as a key signing key ignoring any
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley key flags. This option may be specified multiple times.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley Generate a DLV set in addition to the key (DNSKEY) and DS sets.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley The domain is appended to the name of the records.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<dt><span class="term">-M <em class="replaceable"><code>maxttl</code></em></span></dt>
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley Sets the maximum TTL for the signed zone.
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley Any TTL higher than <em class="replaceable"><code>maxttl</code></em> in the
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley input zone will be reduced to <em class="replaceable"><code>maxttl</code></em>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley in the output. This provides certainty as to the largest
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley possible TTL in the signed zone, which is useful to know when
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley rolling keys because it is the longest possible time before
3740b569ae76295b941d57a724a43beb75b533baBob Halley signatures that have been retrieved by resolvers will expire
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley from resolver caches. Zones that are signed with this
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley option should be configured to use a matching
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley <code class="option">max-zone-ttl</code> in <code class="filename">named.conf</code>.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley (Note: This option is incompatible with <code class="option">-D</code>,
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley because it modifies non-DNSSEC data in the output zone.)
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley Specify the date and time when the generated RRSIG records
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley become valid. This can be either an absolute or relative
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley time. An absolute start time is indicated by a number
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley in YYYYMMDDHHMMSS notation; 20000530144500 denotes
3740b569ae76295b941d57a724a43beb75b533baBob Halley 14:45:00 UTC on May 30th, 2000. A relative start time is
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley indicated by +N, which is N seconds from the current time.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley If no <code class="option">start-time</code> is specified, the current
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley time minus 1 hour (to allow for clock skew) is used.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley Specify the date and time when the generated RRSIG records
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley expire. As with <code class="option">start-time</code>, an absolute
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley time is indicated in YYYYMMDDHHMMSS notation. A time relative
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley to the start time is indicated with +N, which is N seconds from
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley the start time. A time relative to the current time is
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley indicated with now+N. If no <code class="option">end-time</code> is
3740b569ae76295b941d57a724a43beb75b533baBob Halley specified, 30 days from the start time is used as a default.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley <code class="option">end-time</code> must be later than
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<dt><span class="term">-X <em class="replaceable"><code>extended end-time</code></em></span></dt>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley Specify the date and time when the generated RRSIG records
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley for the DNSKEY RRset will expire. This is to be used in cases
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley when the DNSKEY signatures need to persist longer than
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley signatures on other records; e.g., when the private component
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley of the KSK is kept offline and the KSK signature is to be
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley refreshed manually.
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley As with <code class="option">start-time</code>, an absolute
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley time is indicated in YYYYMMDDHHMMSS notation. A time relative
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley to the start time is indicated with +N, which is N seconds from
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley the start time. A time relative to the current time is
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley indicated with now+N. If no <code class="option">extended end-time</code> is
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley specified, the value of <code class="option">end-time</code> is used as
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley the default. (<code class="option">end-time</code>, in turn, defaults to
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley 30 days from the start time.) <code class="option">extended end-time</code>
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley must be later than <code class="option">start-time</code>.
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley<dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt>
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley The name of the output file containing the signed zone. The
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley default is to append <code class="filename">.signed</code> to
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley the input filename. If <code class="option">output-file</code> is
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley set to <code class="literal">"-"</code>, then the signed zone is
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley written to the standard output, with a default output
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley format of "full".
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley Prints a short summary of the options and arguments to
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley <span><strong class="command">dnssec-signzone</strong></span>.
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley Prints version information.
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley When a previously-signed zone is passed as input, records
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley may be resigned. The <code class="option">interval</code> option
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley specifies the cycle interval as an offset from the current
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley time (in seconds). If a RRSIG record expires after the
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley cycle interval, it is retained. Otherwise, it is considered
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley to be expiring soon, and it will be replaced.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley The default cycle interval is one quarter of the difference
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley between the signature end and start times. So if neither
3740b569ae76295b941d57a724a43beb75b533baBob Halley <code class="option">end-time</code> or <code class="option">start-time</code>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley are specified, <span><strong class="command">dnssec-signzone</strong></span>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley signatures that are valid for 30 days, with a cycle
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley interval of 7.5 days. Therefore, if any existing RRSIG records
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley are due to expire in less than 7.5 days, they would be
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley The format of the input zone file.
3740b569ae76295b941d57a724a43beb75b533baBob Halley Possible formats are <span><strong class="command">"text"</strong></span> (default),
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley <span><strong class="command">"raw"</strong></span>, and <span><strong class="command">"map"</strong></span>.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley This option is primarily intended to be used for dynamic
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley signed zones so that the dumped zone file in a non-text
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley format containing updates can be signed directly.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley The use of this option does not make much sense for
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley non-dynamic zones.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley<dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt>
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley When signing a zone with a fixed signature lifetime, all
3740b569ae76295b941d57a724a43beb75b533baBob Halley RRSIG records issued at the time of signing expires
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley simultaneously. If the zone is incrementally signed, i.e.
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley a previously-signed zone is passed as input to the signer,
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley all expired signatures have to be regenerated at about the
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley same time. The <code class="option">jitter</code> option specifies a
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley jitter window that will be used to randomize the signature
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley expire time, thus spreading incremental signature
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley regeneration over time.
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley Signature lifetime jitter also to some extent benefits
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley validators and servers by spreading out cache expiration,
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley i.e. if large numbers of RRSIGs don't expire at the same time
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley from all caches there will be less congestion than if all
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley validators need to refetch at mostly the same time.
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley<dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt>
c98d185d0cd20b745b4e3d62aa6fcc22ac0e7c51Bob Halley When writing a signed zone to "raw" or "map" format, set the
005df5aba5181dc57b0e84eae72929f009b6b8fdBob Halley "source serial" value in the header to the specified serial
7b5e3afd21d4f1792812ab371ee687807235dd87Bob Halley number. (This is expected to be used primarily for testing
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt>
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley Specifies the number of threads to use. By default, one
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley thread is started for each detected CPU.
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt>
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley The SOA serial number format of the signed zone.
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley Possible formats are <span><strong class="command">"keep"</strong></span> (default),
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley <span><strong class="command">"increment"</strong></span>, <span><strong class="command">"unixtime"</strong></span>,
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley and <span><strong class="command">"date"</strong></span>.
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dt><span class="term"><span><strong class="command">"keep"</strong></span></span></dt>
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dd><p>Do not modify the SOA serial number.</p></dd>
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dt><span class="term"><span><strong class="command">"increment"</strong></span></span></dt>
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dd><p>Increment the SOA serial number using RFC 1982
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dt><span class="term"><span><strong class="command">"unixtime"</strong></span></span></dt>
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dd><p>Set the SOA serial number to the number of seconds
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dt><span class="term"><span><strong class="command">"date"</strong></span></span></dt>
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dd><p>Set the SOA serial number to today's date in
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley The zone origin. If not specified, the name of the zone file
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley is assumed to be the origin.
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley<dt><span class="term">-O <em class="replaceable"><code>output-format</code></em></span></dt>
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley The format of the output file containing the signed zone.
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley Possible formats are <span><strong class="command">"text"</strong></span> (default),
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley which is the standard textual representation of the zone;
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley <span><strong class="command">"full"</strong></span>, which is text output in a
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley format suitable for processing by external scripts;
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley and <span><strong class="command">"map"</strong></span>, <span><strong class="command">"raw"</strong></span>,
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley and <span><strong class="command">"raw=N"</strong></span>, which store the zone in
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley binary formats for rapid loading by <span><strong class="command">named</strong></span>.
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley <span><strong class="command">"raw=N"</strong></span> specifies the format version of
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley the raw zone file: if N is 0, the raw file can be read by
63bd57250ebc55355cac6560aa0efdc887b67140Bob Halley any version of <span><strong class="command">named</strong></span>; if N is 1, the file
Kexample.com.+003+17247