RNDC-CONFGEN(8) BIND 9 RNDC-CONFGEN(8)

# [NAME](#NAME)

rndc-confgen - rndc key generation tool

# [SYNOPSIS](#SYNOPSIS)

**rndc-confgen** \[**-a**] \[**-A** algorithm] \[**-b** keysize] \[**-c** keyfile] \[**-h**] \[**-k** keyname] \[**-p** port] \[**-s** address] \[**-t** chrootdir] \[**-u** user]

# [DESCRIPTION](#DESCRIPTION)

**rndc-confgen** generates configuration files for **rndc** <#std-iscman-rndc>. It can be used as a convenient alternative to writing the **rndc.conf** <#std-iscman-rndc.conf> file and the corresponding **controls** and **key** statements in **named.conf** <#std-iscman-named.conf> by hand. Alternatively, it can be run with the **-a** option to set up a **rndc.key** file and avoid the need for a **rndc.conf** <#std-iscman-rndc.conf> file and a **controls** statement altogether.

# [OPTIONS](#OPTIONS)

[**-a**](#a)

This option sets automatic **rndc** <#std-iscman-rndc> configuration, which creates a file **/etc/bind/rndc.key** that is read by both **rndc** <#std-iscman-rndc> and **named** <#std-iscman-named> on startup. The **rndc.key** file defines a default command channel and authentication key allowing **rndc** <#std-iscman-rndc> to communicate with **named** <#std-iscman-named> on the local host with no further configuration.

If a more elaborate configuration than that generated by **rndc-confgen -a** is required, for example if rndc is to be used remotely, run **rndc-confgen** without the **-a** option and set up **rndc.conf** <#std-iscman-rndc.conf> and **named.conf** <#std-iscman-named.conf> as directed.

[**-A algorithm**](#A)

This option specifies the algorithm to use for the TSIG key. Available choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and hmac-sha512. The default is hmac-sha256.

[**-b keysize**](#b)

This option specifies the size of the authentication key in bits. The size must be between 1 and 512 bits; the default is the hash size.

[**-c keyfile**](#c)

This option is used with the **-a** option to specify an alternate location for **rndc.key**.

[**-h**](#h)

This option prints a short summary of the options and arguments to **rndc-confgen**.

[**-k keyname**](#k)

This option specifies the key name of the **rndc** <#std-iscman-rndc> authentication key. This must be a valid domain name and will be sanitized using the domain name semantics. The default is **rndc-key**.

[**-p port**](#p)

This option specifies the command channel port where **named** <#std-iscman-named> listens for connections from **rndc** <#std-iscman-rndc>. The default is 953.

[**-q**](#q)

This option prevets printing the written path in automatic configuration mode.

[**-s address**](#s)

This option specifies the IP address where **named** <#std-iscman-named> listens for command-channel connections from **rndc** <#std-iscman-rndc>. The default is the loopback address 127.0.0.1.

[**-t chrootdir**](#t)

This option is used with the **-a** option to specify a directory where **named** <#std-iscman-named> runs chrooted. An additional copy of the **rndc.key** is written relative to this directory, so that it is found by the chrooted **named** <#std-iscman-named>.

[**-u user**](#u)

This option is used with the **-a** option to set the owner of the generated **rndc.key** file. If **-t** is also specified, only the file in the chroot area has its owner changed.

# [EXAMPLES](#EXAMPLES)

To allow **rndc** <#std-iscman-rndc> to be used with no manual configuration, run:

**rndc-confgen -a**

To print a sample **rndc.conf** <#std-iscman-rndc.conf> file and the corresponding **controls** and **key** statements to be manually inserted into **named.conf** <#std-iscman-named.conf>, run:

**rndc-confgen**

# [SEE ALSO](#SEE_ALSO)

[**rndc(8)**](/man/os/bind/rndc.8) <#std-iscman-rndc>, [**rndc.conf(5)**](/man/os/bind/rndc.conf.5) <#std-iscman-rndc.conf>, [**named(8)**](/man/os/bind/named.8) <#std-iscman-named>, BIND 9 Administrator Reference Manual.

# [Author](#Author)

Internet Systems Consortium

# [Copyright](#Copyright)

2026, Internet Systems Consortium

2026-11-05 9.20.30

---

Document: rndc-confgen(8) from bind 9.20.30-r1 (Chainguard OS)
Source: https://gitlab.isc.org/isc-projects/bind9.git