/usr/bin/dnssec-signzone --help — Chainguard OS Manuals

From bind-dnssec-tools 9.20.30-r1 (os), captured 2026-11-05 by running dnssec-signzone --help (exit 1). permalink

/usr/bin/dnssec-signzone: illegal option -- -
dnssec-signzone: invalid argument --
Usage:
	dnssec-signzone [options] zonefile [keys]

Version: 9.20.30
Options: (default value in parenthesis)
	-S:	smart signing: automatically finds key files
		for the zone and determines how they are to be used
	-K directory:
		directory to find key files (.)
	-d directory:
		directory to find dsset-* files (.)
	-F:	FIPS mode
	-g:	update DS records based on child zones' dsset-* files
	-G sync-records:	what CDNSKEY and CDS to publish
	-s [YYYYMMDDHHMMSS|+offset]:
		RRSIG start time - absolute|offset (now - 1 hour)
	-e [YYYYMMDDHHMMSS|+offset|"now"+offset]:
		RRSIG end time - absolute|from start|from now (now + 30 days)
	-X [YYYYMMDDHHMMSS|+offset|"now"+offset]:
		DNSKEY RRSIG end - absolute|from start|from now (matches -e)
	-i interval:
		cycle interval - resign if < interval from end ( (end-start)/4 )
	-j jitter:
		randomize signature end time up to jitter seconds
	-v debuglevel (0)
	-q quiet
	-V:	print version information
	-o origin:
		zone origin (name of zonefile)
	-f outfile:
		file the signed zone is written in (zonefile + .signed)
	-I format:
		file format of input zonefile (text)
	-O format:
		file format of signed zone file (text)
	-N format:
		soa serial format of signed zone file (keep)
	-D:
		output only DNSSEC-related records
	-a:	verify generated signatures
	-c class (IN)
	-E engine:
		name of an OpenSSL engine to use
	-P:	disable post-sign verification
	-Q:	remove signatures from keys that are no longer active
	-R:	remove signatures from keys that no longer exist
	-T TTL:	TTL for newly added DNSKEYs
	-t:	print statistics
	-u:	update or replace an existing NSEC/NSEC3 chain
	-x:	sign DNSKEY record with KSKs only, not ZSKs
	-z:	sign all records with KSKs
	-C:	generate a keyset file, for compatibility
		with older versions of dnssec-signzone -g
	-n ncpus (number of cpus present)
	-k key_signing_key
	-3 NSEC3 salt
	-H NSEC3 additional iterations (0)
	-A NSEC3 optout

Signing Keys: (default: all zone keys that have private keys)
	keyfile (Kname+alg+tag)

Options (42)

Option	Description	Source
`-S`	This option enables smart signing, which instructs dnssec-signzone to search the key repository for keys that match the zone being signed, and to include them in the zone if appropriate.	help + man
`-K` directory:	This option specifies the directory to search for DNSSEC keys.	help + man
`-d` directory:	This option indicates the directory where BIND 9 should look for dsset- or keyset- files.	help + man
`-F`	This options turns on FIPS (US Federal Information Processing Standards) mode if the underlying crytographic library supports running in FIPS mode.	help + man
`-g`	This option indicates that DS records for child zones should be generated from a dsset- or keyset- file.	help + man
`-G` sync-records:	This option indicates which CDS and CDNSKEY records should be generated.	help + man
`-s` YYYYMMDDHHMMSS\|+offset]:	This option specifies the date and time when the generated RRSIG records become valid.	help + man
`-e` YYYYMMDDHHMMSS\|+offset\|"now"+offset]:	This option specifies the date and time when the generated RRSIG records expire.	help + man
`-X` YYYYMMDDHHMMSS\|+offset\|"now"+offset]:	This option specifies the date and time when the generated RRSIG records for the DNSKEY RRset expire.	help + man
`-i` interval:	This option indicates that, when a previously signed zone is passed as input, records may be re-signed.	help + man
`-j` jitter:	When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expire simultaneously.	help + man
`-q` quiet	This option enables quiet mode, which suppresses unnecessary output.	help + man
`-V`	This option prints version information.	help + man
`-o` origin:	This option sets the zone origin.	help + man
`-f` outfile:	This option indicates the name of the output file containing the signed zone.	help + man
`-I` format:	This option sets the format of the input zone file.	help + man
`-O` format:	This option sets the format of the output file containing the signed zone.	help + man
`-N` format:	This option sets the SOA serial number format of the signed zone.	help + man
`-D`	This option indicates that only those record types automatically managed by dnssec-signzone, i.e., RRSIG, NSEC, NSEC3 and NSEC3PARAM records, should be included in the output.	help + man
`-a`	This option verifies all generated signatures.	help + man
`-E` engine:	This option specifies the hardware to use for cryptographic operations, such as a secure key store used for signing, when applicable.	help + man
`-P`	This option disables post-sign verification tests.	help + man
`-Q`	This option removes signatures from keys that are no longer active.	help + man
`-R`	This option removes signatures from keys that are no longer published.	help + man
`-T` TTL:	This option specifies a TTL to be used for new DNSKEY records imported into the zone from the key repository.	help + man
`-t`	This option prints statistics at completion.	help + man
`-u`	This option updates the NSEC/NSEC3 chain when re-signing a previously signed zone.	help + man
`-x`	This option indicates that BIND 9 should only sign the DNSKEY, CDNSKEY, and CDS RRsets with key-signing keys, and should omit signatures from zone-signing keys.	help + man
`-z`	This option indicates that BIND 9 should ignore the KSK flag on keys when determining what to sign.	help + man
`-C`	This option sets compatibility mode, in which a keyset-zonename file is generated in addition to dsset-zonename when signing a zone, for use by older versions of dnssec-signzone.	help + man
`-k` key_signing_key	This option tells BIND 9 to treat the specified key as a key-signing key, ignoring any key flags.	help + man
`-c` class	This option specifies the DNS class of the zone. (in the manual page but not in --help)	man
`-J` filename	This option tells dnssec-signzone to read the journal from the given file when loading the zone file. (in the manual page but not in --help)	man
`-M` maxttl	This option sets the maximum TTL for the signed zone. (in the manual page but not in --help)	man
`-h`	This option prints a short summary of the options and arguments to dnssec-signzone. (in the manual page but not in --help)	man
`-L` serial	When writing a signed zone to "raw" format, this option sets the "source serial" value in the header to the specified serial number. (in the manual page but not in --help)	man
`-n` ncpus	This option specifies the number of threads to use. (in the manual page but not in --help)	man
`-v` level	This option sets the debugging level. (in the manual page but not in --help)	man
`-3` salt	This option generates an NSEC3 chain with the given hex-encoded salt. (in the manual page but not in --help)	man
`-H` iterations	This option indicates that, when generating an NSEC3 chain, BIND 9 should use this many iterations. (in the manual page but not in --help)	man
`-A`	This option indicates that, when generating an NSEC3 chain, BIND 9 should set the OPTOUT flag on all NSEC3 records and should not generate NSEC3 records for insecure delegations. (in the manual page but not in --help)	man
`-AA`	This option turns the OPTOUT flag off for all records. (in the manual page but not in --help)	man

Examples (2) from the manual page, untested

% dnssec-signzone -g -o example.com db.example.com \
The following command signs the example.com zone with the ECDSAP256SHA256 key generated by dnssec-keygen <#std-iscman-dnssec-keygen> (Kexample.com.+013+17247).
% cp db.example.com.signed db.example.com
This example re-signs a previously signed zone with default parameters.

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.