/usr/bin/dnssec-keyfromlabel --help — Chainguard OS Manuals

From bind-dnssec-tools 9.20.30-r1 (os), captured 2026-11-05 by running dnssec-keyfromlabel --help (exit 1). permalink

dnssec-keyfromlabel: invalid argument --
Usage:
    dnssec-keyfromlabel -l label [options] name

Version: 9.20.30
Required options:
    -l label: label of the key pair
    name: owner of the key
Other options:
    -a algorithm:
        RSASHA1 (deprecated) |
        NSEC3RSASHA1 (deprecated) |
        RSASHA256 | RSASHA512 |
        ECDSAP256SHA256 | ECDSAP384SHA384 |
        ED25519 | ED448
    -3: use NSEC3-capable algorithm
    -c class (default: IN)
    -E <engine>:
        name of an OpenSSL engine to use
    -f keyflag: KSK | REVOKE
    -K directory: directory in which to place key files
    -k: generate a TYPE=KEY key
    -L ttl: default key TTL
    -M <min>:<max>: allowed Key ID range
    -n nametype: ZONE | HOST | ENTITY | USER | OTHER
        (DNSKEY generation defaults to ZONE
    -p protocol: default: 3 [dnssec]
    -t type: AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF (default: AUTHCONF)
    -y: permit keys that might collide
    -v verbose level
    -V: print version information
Date options:
    -P date/[+-]offset: set key publication date
    -P sync date/[+-]offset: set CDS and CDNSKEY publication date
    -A date/[+-]offset: set key activation date
    -R date/[+-]offset: set key revocation date
    -I date/[+-]offset: set key inactivation date
    -D date/[+-]offset: set key deletion date
    -D sync date/[+-]offset: set CDS and CDNSKEY deletion date
    -G: generate key only; do not set -P or -A
    -C: generate a backward-compatible key, omitting all dates
    -S <key>: generate a successor to an existing key
    -i <interval>: prepublication interval for successor key (default: 30 days)
Output:
     K<name>+<alg>+<id>.key, K<name>+<alg>+<id>.private

Options (26)

Option	Description	Source
`-a` algorithm:	RSASHA1 (deprecated) \| NSEC3RSASHA1 (deprecated) \| RSASHA256 \| RSASHA512 \| ECDSAP256SHA256 \| ECDSAP384SHA384 \| ED25519 \| ED448	help + man
`-E` engine>:	This option specifies the cryptographic hardware to use.	help + man
`-3`	This option uses an NSEC3-capable algorithm to generate a DNSSEC key. (in the manual page but not in --help)	man
`-l` label	This option specifies the label for a key pair in the crypto hardware. (in the manual page but not in --help)	man
`-n` nametype	This option specifies the owner type of the key. (in the manual page but not in --help)	man
`-C`	This option enables compatibility mode, which generates an old-style key, without any metadata. (in the manual page but not in --help)	man
`-c` class	This option indicates that the DNS record containing the key should have the specified class. (in the manual page but not in --help)	man
`-f` flag	This option sets the specified flag in the flag field of the KEY/DNSKEY record. (in the manual page but not in --help)	man
`-G`	This option generates a key, but does not publish it or sign with it. (in the manual page but not in --help)	man
`-h`	This option prints a short summary of the options and arguments to dnssec-keyfromlabel. (in the manual page but not in --help)	man
`-K` directory	This option sets the directory in which the key files are to be written. (in the manual page but not in --help)	man
`-k`	This option generates KEY records rather than DNSKEY records. (in the manual page but not in --help)	man
`-L` ttl	This option sets the default TTL to use for this key when it is converted into a DNSKEY RR. (in the manual page but not in --help)	man
`-M` tag_min:tag_max	This option sets the range of key tag values that dnssec-keyfromlabel will accept. (in the manual page but not in --help)	man
`-p` protocol	This option sets the protocol value for the key. (in the manual page but not in --help)	man
`-S` key	This option generates a key as an explicit successor to an existing key. (in the manual page but not in --help)	man
`-t` type	This option indicates the type of the key. (in the manual page but not in --help)	man
`-v` level	This option sets the debugging level. (in the manual page but not in --help)	man
`-V`	This option prints version information. (in the manual page but not in --help)	man
`-y`	This option allows DNSSEC key files to be generated even if the key ID would collide with that of an existing key, in the event of either key being revoked. (in the manual page but not in --help)	man
`-P` date/offset	This option sets the date on which a key is to be published to the zone. (in the manual page but not in --help)	man
`-A` date/offset	This option sets the date on which the key is to be activated. (in the manual page but not in --help)	man
`-R` date/offset	This option sets the date on which the key is to be revoked. (in the manual page but not in --help)	man
`-I` date/offset	This option sets the date on which the key is to be retired. (in the manual page but not in --help)	man
`-D` date/offset	This option sets the date on which the key is to be deleted. (in the manual page but not in --help)	man
`-i` interval	This option sets the prepublication interval for a key. (in the manual page but not in --help)	man

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.