Usage:
pdnsutil [options] <command> [params...]

Autoprimary Commands:

autoprimary add IP NAMESERVER [ACCOUNT]
	Add a new autoprimary
autoprimary list
	List all autoprimaries
autoprimary remove IP NAMESERVER
	Remove an autoprimary

Catalog Zone Commands:

catalog list-members CATALOG
	List all members of catalog zone CATALOG
catalog set ZONE [CATALOG]
	Change the catalog of ZONE to CATALOG, or removes ZONE from its current
	catalog if no catalog provided

Zone Metadata Commands:

metadata add ZONE KIND VALUE [VALUE...]
	Add zone metadata, this adds to the existing KIND
metadata get ZONE [KIND...]
	Get zone metadata. If no KIND is given, lists all known
metadata set ZONE KIND [VALUE...]
	Set zone metadata, replacing all existing records of KIND, optionally
	providing a value. An omitted value clears the metadata

Networks Commands:

network list
	List all defined networks with their chosen views
network set NET [VIEW]
	Set the view for a network, or delete if no view argument.

Zone Record Commands:

rrset add ZONE NAME TYPE [TTL] "CONTENT" ["CONTENT"...]
	Add one or more records to the given rrset in ZONE
rrset add-comment ZONE NAME TYPE COMMENT [ACCOUNT]
	Add a comment
rrset delete ZONE NAME TYPE
	Delete named rrset from ZONE
rrset hash ZONE NAME
	Calculate the NSEC3 hash for NAME in ZONE
rrset list-comments ZONE
	List comments for a zone
rrset replace ZONE NAME TYPE [TTL] "CONTENT" ["CONTENT"...]
	Replace named rrset from ZONE

TSIG Key Commands:

tsigkey activate ZONE NAME {primary|secondary|producer|consumer}
	Enable TSIG authenticated AXFR using the key NAME for ZONE
tsigkey deactivate ZONE NAME {primary|secondary|producer|consumer}
	Disable TSIG authenticated AXFR using the key NAME for ZONE
tsigkey delete NAME
	Delete TSIG key (warning: will not unmap key!)
tsigkey generate NAME ALGORITHM
	Generate new TSIG key.
	ALGORITHM is one of hmac-{md5,sha1,sha224,sha256,sha384,sha512}
tsigkey import NAME ALGORITHM KEY
	Import TSIG key
tsigkey list
	List all TSIG keys

Views Commands:

view add-zone VIEW ZONE..VARIANT
	Add a zone variant to a view
view del-zone VIEW ZONE..VARIANT
	Remove a zone variant from a view
view list VIEW
	List all zones within VIEW
view list-all
	List all view names

Zone Commands:

zone check ZONE
	Check a zone for correctness
zone check-all [exit-on-error]
	Check all zones for correctness. Use exit-on-error to exit immediately
	upon finding the first error in any zone
zone clear ZONE
	Clear all records of a zone, but keep everything else
zone copy ZONE NEW-ZONE
	Create zone NEW-ZONE with the contents of ZONE
zone create ZONE [NSNAME]
	Create empty zone ZONE
zone delete ZONE
	Delete zone ZONE
zone edit ZONE
	Edit zone contents using $EDITOR
zone increase-serial ZONE
	Increases the SOA-serial by 1. Uses SOA-EDIT
zone list ZONE
	List zone contents
zone list-all [primary|secondary|native|producer|consumer]
	List all active zone names.
	Use --verbose (-v) to include disabled or empty zones
zone load ZONE FILENAME [ZONE FILENAME]...
	Load ZONE from FILENAME, possibly creating zone or atomically replacing
	contents; --verbose or -v will also include the keys for disabled or
	empty zones
zone set-account ZONE ACCOUNT
	Change the account (owner) of ZONE to ACCOUNT
zone set-kind ZONE KIND
	Change the kind of ZONE to KIND (primary, secondary, native, producer,
	or consumer)
zone set-option ZONE [producer|consumer] [coo|unique|group] VALUE [VALUE...]
	Set or remove an option for ZONE. Providing an empty value removes the
	option
zone set-options-json ZONE JSONFILE
	Change the options of ZONE to JSONFILE
zone show ZONE
	Show various details about a zone, including DNSSEC keys
zone zonemd-verify-file ZONE FILENAME
	Validate ZONEMD for ZONE

Secondary Zone Commands:

zone change-primary ZONE PRIMARY_IP [PRIMARY_IP...]
	Change secondary zone ZONE primary IP address(es) to PRIMARY_IP
zone create-secondary ZONE PRIMARY_IP [PRIMARY_IP...]
	Create secondary zone ZONE with primary IP address(es) PRIMARY_IP

DNSSEC Commands:

zone dnssec-disable ZONE
	Deactivate all keys and unset PRESIGNED in ZONE
zone export-dnskey ZONE KEY_ID
	Export the public DNSKEY with the given ID to stdout
zone export-ds ZONE
	Export all KSK DS records for ZONE to stdout
zone list-keys [ZONE]
	List DNSSEC keys for ZONE.
	When ZONE is unset, display keys for all active zones
zone rectify ZONE [ZONE...]
	Fix up DNSSEC fields (order, auth)
zone rectify-all [quiet]
	Rectify all zones. Optionally quiet output with errors only
zone secure ZONE [ZONE...]
	Add DNSSEC to zone ZONE
zone secure-all [increase-serial]
	Secure all zones without keys
zone set-nsec3 ZONE ['PARAMS' [narrow]]
	Enable NSEC3 with PARAMS (default: '1 0 0 -'). Optionally narrow
zone set-presigned ZONE
	Use presigned RRSIGs from storage
zone set-publish-cdnskey ZONE [delete]
	Enable sending CDNSKEY responses for ZONE. Add 'delete' to publish
	a CDNSKEY with a DNSSEC delete algorithm
zone set-publish-cds ZONE [DIGESTALGOS]
	Enable sending CDS responses for ZONE, using DIGESTALGOS as signature
	algorithms; DIGESTALGOS should be a comma-separated list of numbers,
	(default: '2')
zone set-signaling ZONE
	Configure zone for RFC 9615 DNSSEC bootstrapping
	(zone name must begin with _signal.)
zone unset-nsec3 ZONE
	Switch ZONE back to NSEC
zone unset-presigned ZONE
	Stop using presigned RRSIGs on ZONE
zone unset-publish-cdnskey ZONE
	Disable sending CDNSKEY responses for ZONE
zone unset-publish-cds ZONE
	Disable sending CDS responses for ZONE

Zone Key Commands:

zone activate-key ZONE KEY_ID
	Activate the key with key id KEY_ID in ZONE
zone add-key ZONE [zsk|ksk] [BITS] [active|inactive] [published|unpublished]
    [rsasha1|rsasha1-nsec3-sha1|rsasha256|rsasha512|ecdsa256|ecdsa384|ed25519|ed448]
	Add a ZSK or KSK to zone with specific algorithm and size in bits.
	If zsk or ksk is omitted, defaults to zsk
zone deactivate-key ZONE KEY_ID
	Deactivate the key with key id KEY_ID in ZONE
zone export-key ZONE KEY_ID
	Export the private key with the given ID to stdout
zone export-key-pem ZONE KEY_ID
	Export the private key with the given ID to stdout in PEM format
zone generate-key {zsk|ksk} [ALGORITHM] [BITS]
	Generate a ZSK or KSK to stdout with specified ALGORITHM and BITS
zone import-key ZONE FILE [active|inactive] [ksk|zsk] [published|unpublished]
	Import from a private key file, ZSK or KSK; defaults to KSK, active
	and published
zone import-key-pem ZONE FILE ALGORITHM [ksk|zsk]}
	Import a private key from a PEM file
zone publish-key ZONE KEY_ID
	Publish the zone key with key id KEY_ID in ZONE
zone remove-key ZONE KEY_ID
	Remove key with KEY_ID from ZONE
zone unpublish-key ZONE KEY_ID
	Unpublish the zone key with key id KEY_ID in ZONE

Other/Miscellaneous Commands:

b2b-migrate OLD NEW
	Move all data from one backend to another
backend-cmd BACKEND CMD [CMD...]
	Perform one or more backend commands
backend-lookup BACKEND NAME [[TYPE] CLIENT_IP_SUBNET]
	Perform a backend lookup of NAME, TYPE (defaulting to ANY) and
	CLIENT_IP_SUBNET
bench-db [FILENAME]
	Benchmark database backend with queries, one zone per line
create-bind-db FILENAME
	Create DNSSEC db for BIND backend (bind-dnssec-db)
hash-password [WORK FACTOR]
	Ask for a plaintext password or API key and output a salted and hashed
	version
ipdecrypt IP_ADDRESS PASSPHRASE_OR_KEY [key]
	Decrypt IP address using passphrase or base64 key
ipencrypt IP_ADDRESS PASSPHRASE_OR_KEY [key]
	Encrypt IP address using passphrase or base64 key
list-algorithms [with-backend]
	List all DNSSEC algorithms supported, optionally also listing the
	cryptographic library used
lmdb-get-backend-version
	Get schema version supported by backend
raw-lua-from-content TYPE CONTENT
	Display record contents in a form suitable for dnsdist's
	`SpoofRawAction`
test-schema ZONE
	Test DB schema - will create ZONE

Common options:
  -h [ --help ]            produce help message
  --version                show version
  -v [ --verbose ]         be verbose
  -f [ --force ]           force an action
  -q [ --quiet ]           be quiet
  -s [ --sort ]            sort output when applicable
  --config-name arg        virtual configuration name
  --config-dir arg (=/etc) location of pdns.conf
  --no-colors              do not use colors in output
  --commands arg