DNSSEC-REVOKE(1) BIND 9 DNSSEC-REVOKE(1)

# [NAME](#NAME)

dnssec-revoke - set the REVOKED bit on a DNSSEC key

# [SYNOPSIS](#SYNOPSIS)

**dnssec-revoke** \[**-hr**] \[**-v** level] \[**-V**] \[**-K** directory] \[**-E** engine] \[**-f**] \[**-R**] {keyfile}

# [DESCRIPTION](#DESCRIPTION)

**dnssec-revoke** reads a DNSSEC key file, sets the REVOKED bit on the key as defined in **RFC 5011** <https://datatracker.ietf.org/doc/html/rfc5011.html>, and creates a new pair of key files containing the now-revoked key.

# [OPTIONS](#OPTIONS)

[**-h**](#h)

This option emits a usage message and exits.

[**-K directory**](#K)

This option sets the directory in which the key files are to reside.

[**-r**](#r)

This option indicates to remove the original keyset files after writing the new keyset files.

[**-v level**](#v)

This option sets the debugging level.

[**-V**](#V)

This option prints version information.

[**-E engine**](#E)

This option specifies the cryptographic hardware to use, when applicable.

When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL engine identifier that drives the cryptographic accelerator or hardware service module (usually **pkcs11**).

[**-f**](#f)

This option indicates a forced overwrite and causes **dnssec-revoke** to write the new key pair, even if a file already exists matching the algorithm and key ID of the revoked key.

[**-R**](#R)

This option prints the key tag of the key with the REVOKE bit set, but does not revoke the key.

# [SEE ALSO](#SEE_ALSO)

[**dnssec-keygen(8)**](/man/os/bind/dnssec-keygen.8) <#std-iscman-dnssec-keygen>, BIND 9 Administrator Reference Manual, **RFC 5011** <https://datatracker.ietf.org/doc/html/rfc5011.html>.

# [Author](#Author)

Internet Systems Consortium

# [Copyright](#Copyright)

2026, Internet Systems Consortium

2026-11-05 9.20.30

---

Document: dnssec-revoke(1) from bind 9.20.30-r1 (Chainguard OS)
Source: https://gitlab.isc.org/isc-projects/bind9.git