/usr/bin/dnssec-keygen --help — Chainguard OS Manuals

From bind-dnssec-tools 9.20.30-r1 (os), captured 2026-11-05 by running dnssec-keygen --help (exit 1). permalink

dnssec-keygen: invalid argument --
Usage:
    dnssec-keygen [options] name

Version: 9.20.30
    name: owner of the key
Options:
    -K <directory>: write keys into directory
    -k <policy>: generate keys for dnssec-policy
    -l <file>: configuration file with dnssec-policy statement
    -a <algorithm>:
        RSASHA1 (deprecated) | NSEC3RSASHA1 (deprecated) |
        RSASHA256 | RSASHA512 |
        ECDSAP256SHA256 | ECDSAP384SHA384 |
        ED25519 | ED448
    -3: use NSEC3-capable algorithm
    -b <key size in bits>:
        RSASHA1 (deprecated) :	[1024..4096]
        NSEC3RSASHA1 (deprecated) :	[1024..4096]
        RSASHA256:	[1024..4096]
        RSASHA512:	[1024..4096]
        ECDSAP256SHA256:	ignored
        ECDSAP384SHA384:	ignored
        ED25519:	ignored
        ED448:	ignored
        (key size defaults are set according to
        algorithm and usage (ZSK or KSK)
    -n <nametype>: ZONE | HOST | ENTITY | USER | OTHER
        (DNSKEY generation defaults to ZONE)
    -c <class>: (default: IN)
    -d <digest bits> (0 => max, default)
    -E <engine>:
        name of an OpenSSL engine to use
    -f <keyflag>: ZSK | KSK | REVOKE
    -F: FIPS mode
    -L <ttl>: default key TTL
    -M <min>:<max>: allowed Key ID range
    -p <protocol>: (default: 3 [dnssec])
    -s <strength>: strength value this key signs DNS records with (default: 0)
    -T <rrtype>: DNSKEY | KEY (default: DNSKEY; use KEY for SIG(0))
    -t <type>: AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF (default: AUTHCONF)
    -h: print usage and exit
    -m <memory debugging mode>:
       usage | trace | record
    -v <level>: set verbosity level (0 - 10)
    -V: print version information
Timing options:
    -P date/[+-]offset/none: set key publication date (default: now)
    -P sync date/[+-]offset/none: set CDS and CDNSKEY publication date
    -A date/[+-]offset/none: set key activation date (default: now)
    -R date/[+-]offset/none: set key revocation date
    -I date/[+-]offset/none: set key inactivation date
    -D date/[+-]offset/none: set key deletion date
    -D sync date/[+-]offset/none: set CDS and CDNSKEY deletion date
    -G: generate key only; do not set -P or -A
    -C: generate a backward-compatible key, omitting all dates
    -S <key>: generate a successor to an existing key
    -i <interval>: prepublication interval for successor key (default: 30 days)
Output:
     K<name>+<alg>+<id>.key, K<name>+<alg>+<id>.private

Options (31)

Option	Description	Source
`-a` algorithm>:	RSASHA1 (deprecated) \| NSEC3RSASHA1 (deprecated) \| RSASHA256 \| RSASHA512 \| ECDSAP256SHA256 \| ECDSAP384SHA384 \| ED25519 \| ED448	help + man
`-E` engine>:	This option specifies the cryptographic hardware to use, when applicable.	help + man
`-3`	This option uses an NSEC3-capable algorithm to generate a DNSSEC key. (in the manual page but not in --help)	man
`-b` keysize	This option specifies the number of bits in the key. (in the manual page but not in --help)	man
`-C`	This option enables compatibility mode, which generates an old-style key, without any timing metadata. (in the manual page but not in --help)	man
`-c` class	This option indicates that the DNS record containing the key should have the specified class. (in the manual page but not in --help)	man
`-d` bits	This option specifies the key size in bits. (in the manual page but not in --help)	man
`-f` flag	This option sets the specified flag in the flag field of the KEY/DNSKEY record. (in the manual page but not in --help)	man
`-F`	This options turns on FIPS (US Federal Information Processing Standards) mode if the underlying crytographic library supports running in FIPS mode. (in the manual page but not in --help)	man
`-G`	This option generates a key, but does not publish it or sign with it. (in the manual page but not in --help)	man
`-h`	This option prints a short summary of the options and arguments to dnssec-keygen. (in the manual page but not in --help)	man
`-K` directory	This option sets the directory in which the key files are to be written. (in the manual page but not in --help)	man
`-k` policy	This option creates keys for a specific dnssec-policy. (in the manual page but not in --help)	man
`-L` ttl	This option sets the default TTL to use for this key when it is converted into a DNSKEY RR. (in the manual page but not in --help)	man
`-l` file	This option provides a configuration file that contains a dnssec-policy statement (matching the policy set with -k). (in the manual page but not in --help)	man
`-M` tag_min:tag_max	This option sets the range of acceptable key tag values that dnssec-keygen will produce. (in the manual page but not in --help)	man
`-n` nametype	This option specifies the owner type of the key. (in the manual page but not in --help)	man
`-p` protocol	This option sets the protocol value for the generated key, for use with -T KEY. (in the manual page but not in --help)	man
`-q`	This option sets quiet mode, which suppresses unnecessary output, including progress indication. (in the manual page but not in --help)	man
`-S` key	This option creates a new key which is an explicit successor to an existing key. (in the manual page but not in --help)	man
`-s` strength	This option specifies the strength value of the key. (in the manual page but not in --help)	man
`-T` rrtype	This option specifies the resource record type to use for the key. (in the manual page but not in --help)	man
`-t` type	This option indicates the type of the key for use with -T KEY. (in the manual page but not in --help)	man
`-V`	This option prints version information. (in the manual page but not in --help)	man
`-v` level	This option sets the debugging level. (in the manual page but not in --help)	man
`-P` date/offset	This option sets the date on which a key is to be published to the zone. (in the manual page but not in --help)	man
`-A` date/offset	This option sets the date on which the key is to be activated. (in the manual page but not in --help)	man
`-R` date/offset	This option sets the date on which the key is to be revoked. (in the manual page but not in --help)	man
`-I` date/offset	This option sets the date on which the key is to be retired. (in the manual page but not in --help)	man
`-D` date/offset	This option sets the date on which the key is to be deleted. (in the manual page but not in --help)	man
`-i` interval	This option sets the prepublication interval for a key. (in the manual page but not in --help)	man

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.