Usage:
pdnsutil [options] <command> [params ..]

Commands:
activate-tsig-key ZONE NAME {primary|secondary|producer|consumer}
                                   Enable TSIG authenticated AXFR using the key NAME for ZONE
activate-zone-key ZONE KEY-ID      Activate the key with key id KEY-ID in ZONE
add-record ZONE NAME TYPE [ttl] content
             [content..]           Add one or more records to ZONE
add-autoprimary IP NAMESERVER [account]
                                   Add a new autoprimary
remove-autoprimary IP NAMESERVER   Remove an autoprimary
list-autoprimaries                 List all autoprimaries
add-zone-key ZONE {zsk|ksk} [BITS] [active|inactive] [published|unpublished]
             [rsasha1|rsasha1-nsec3-sha1|rsasha256|rsasha512|ecdsa256|ecdsa384|ed25519|ed448]
                                   Add a ZSK or KSK to zone and specify algo&bits
backend-cmd BACKEND CMD [CMD..]    Perform one or more backend commands
b2b-migrate OLD NEW                Move all data from one backend to another
bench-db [filename]                Bench database backend with queries, one zone per line
check-zone ZONE                    Check a zone for correctness
check-all-zones [exit-on-error]    Check all zones for correctness. Set exit-on-error to exit immediately
                                   after finding an error in a zone.
clear-zone ZONE                    Clear all records of a zone, but keep everything else
create-bind-db FNAME               Create DNSSEC db for BIND backend (bind-dnssec-db)
create-secondary-zone ZONE primary-ip [primary-ip..]
                                   Create secondary zone ZONE with primary IP address primary-ip
change-secondary-zone-primary ZONE primary-ip [primary-ip..]
                                   Change secondary zone ZONE primary IP address to primary-ip
create-zone ZONE [nsname]          Create empty zone ZONE
deactivate-tsig-key ZONE NAME {primary|secondary}
                                   Disable TSIG authenticated AXFR using the key NAME for ZONE
deactivate-zone-key ZONE KEY-ID    Deactivate the key with key id KEY-ID in ZONE
delete-rrset ZONE NAME TYPE        Delete named RRSET from zone
delete-tsig-key NAME               Delete TSIG key (warning! will not unmap key!)
delete-zone ZONE                   Delete the zone
disable-dnssec ZONE                Deactivate all keys and unset PRESIGNED in ZONE
edit-zone ZONE                     Edit zone contents using $EDITOR
export-zone-dnskey ZONE KEY-ID     Export to stdout the public DNSKEY described
export-zone-ds ZONE                Export to stdout all KSK DS records for ZONE
export-zone-key ZONE KEY-ID        Export to stdout the private key described
export-zone-key-pem ZONE KEY-ID    Export to stdout in PEM the private key described
generate-tsig-key NAME ALGORITHM   Generate new TSIG key
generate-zone-key {zsk|ksk} [ALGORITHM] [BITS]
                                   Generate a ZSK or KSK to stdout with specified ALGORITHM and BITS
get-meta ZONE [KIND ...]           Get zone metadata. If no KIND given, lists all known
hash-password [WORK FACTOR]        Ask for a plaintext password or api key and output a hashed and salted version
hash-zone-record ZONE RNAME        Calculate the NSEC3 hash for RNAME in ZONE
increase-serial ZONE               Increases the SOA-serial by 1. Uses SOA-EDIT
import-tsig-key NAME ALGORITHM KEY Import TSIG key
import-zone-key ZONE FILE          Import from a file a private key, ZSK or KSK
       [active|inactive] [ksk|zsk] [published|unpublished] Defaults to KSK, active and published
import-zone-key-pem ZONE FILE      Import a private key from a PEM file
        ALGORITHM {ksk|zsk}
ipdecrypt IP passphrase/key [key]  Decrypt IP address using passphrase or base64 key
ipencrypt IP passphrase/key [key]  Encrypt IP address using passphrase or base64 key
load-zone ZONE FILE                Load ZONE from FILE, possibly creating zone or atomically
                                   replacing contents
list-algorithms [with-backend]     List all DNSSEC algorithms supported, optionally also listing the crypto library used
list-keys [ZONE]                   List DNSSEC keys for ZONE. When ZONE is unset, display all keys for all active zones
                                   --verbose or -v will also include the keys for disabled or empty zones
list-zone ZONE                     List zone contents
list-all-zones [primary|secondary|native|producer|consumer]
                                   List all active zone names. --verbose or -v will also include disabled or empty zones
list-member-zones CATALOG          List all members of catalog zone CATALOG
list-tsig-keys                     List all TSIG keys
publish-zone-key ZONE KEY-ID       Publish the zone key with key id KEY-ID in ZONE
rectify-zone ZONE [ZONE ..]        Fix up DNSSEC fields (order, auth)
rectify-all-zones [quiet]          Rectify all zones. Optionally quiet output with errors only
remove-zone-key ZONE KEY-ID        Remove key with KEY-ID from ZONE
replace-rrset ZONE NAME TYPE [ttl] Replace named RRSET from zone
       content [content..]
secure-all-zones [increase-serial] Secure all zones without keys
secure-zone ZONE [ZONE ..]         Add DNSSEC to zone ZONE
set-kind ZONE KIND                 Change the kind of ZONE to KIND (primary, secondary, native, producer, consumer)
set-options-json ZONE JSON         Change the options of ZONE to JSON
set-option ZONE                    Set or remove an option for ZONE Providing an empty value removes an option
  [producer|consumer]
  [coo|unique|group] VALUE
  [VALUE ...]
set-catalog ZONE CATALOG           Change the catalog of ZONE to CATALOG. Setting CATALOG to an empty  removes ZONE from the catalog it is in
set-account ZONE ACCOUNT           Change the account (owner) of ZONE to ACCOUNT
set-nsec3 ZONE ['PARAMS' [narrow]] Enable NSEC3 with PARAMS. Optionally narrow
set-presigned ZONE                 Use presigned RRSIGs from storage
set-publish-cdnskey ZONE [delete]  Enable sending CDNSKEY responses for ZONE. Add 'delete' to publish a CDNSKEY with a
                                   DNSSEC delete algorithm
set-publish-cds ZONE [DIGESTALGOS] Enable sending CDS responses for ZONE, using DIGESTALGOS as signature algorithms
                                   DIGESTALGOS should be a comma separated list of numbers, it is '2' by default
add-meta ZONE KIND VALUE           Add zone metadata, this adds to the existing KIND
                   [VALUE ...]
set-meta ZONE KIND [VALUE] [VALUE] Set zone metadata, optionally providing a value. *No* value clears meta
                                   Note - this will replace all metadata records of KIND!
show-zone ZONE                     Show DNSSEC (public) key details about a zone
unpublish-zone-key ZONE KEY-ID     Unpublish the zone key with key id KEY-ID in ZONE
unset-nsec3 ZONE                   Switch back to NSEC
unset-presigned ZONE               No longer use presigned RRSIGs
unset-publish-cdnskey ZONE         Disable sending CDNSKEY responses for ZONE
unset-publish-cds ZONE             Disable sending CDS responses for ZONE
test-schema ZONE                   Test DB schema - will create ZONE
raw-lua-from-content TYPE CONTENT  Display record contents in a form suitable for dnsdist's `SpoofRawAction`
zonemd-verify-file ZONE FILE       Validate ZONEMD for ZONE
lmdb-get-backend-version           Get schema version supported by backend
Allowed options:
  -h [ --help ]            produce help message
  --version                show version
  -v [ --verbose ]         be verbose
  --force                  force an action
  --config-name arg        virtual configuration name
  --config-dir arg (=/etc) location of pdns.conf
  --no-colors              do not use colors in output
  --commands arg