Usage:
pdnsutil [options] <command> [params...]

Autoprimary Commands:

autoprimary add IP NAMESERVER [ACCOUNT]
	Add a new autoprimary
autoprimary list
	List all autoprimaries
autoprimary remove IP NAMESERVER
	Remove an autoprimary

Catalog Zone Commands:

catalog list-members CATALOG
	List all members of catalog zone CATALOG
catalog set ZONE [CATALOG]
	Change the catalog of ZONE to CATALOG, or removes ZONE from its current
	catalog if no catalog provided

Zone Metadata Commands:

metadata add ZONE KIND VALUE [VALUE...]
	Add zone metadata, this adds to the existing KIND
metadata get ZONE [KIND...]
	Get zone metadata. If no KIND is given, lists all known
metadata set ZONE KIND [VALUE...]
	Set zone metadata, replacing all existing records of KIND, optionally
	providing a value. An omitted value clears the metadata

Networks Commands:

network list
	List all defined networks with their chosen views
network set NET [VIEW]
	Set the view for a network, or delete if no view argument.

Zone Record Commands:

rrset add ZONE NAME TYPE [TTL] "CONTENT" ["CONTENT"...]
	Add one or more records to the given rrset in ZONE
rrset delete ZONE NAME TYPE
	Delete named rrset from ZONE
rrset hash ZONE NAME
	Calculate the NSEC3 hash for NAME in ZONE
rrset replace ZONE NAME TYPE [TTL] "CONTENT" ["CONTENT"...]
	Replace named rrset from ZONE

TSIG Key Commands:

tsigkey activate ZONE NAME {primary|secondary|producer|consumer}
	Enable TSIG authenticated AXFR using the key NAME for ZONE
tsigkey deactivate ZONE NAME {primary|secondary|producer|consumer}
	Disable TSIG authenticated AXFR using the key NAME for ZONE
tsigkey delete NAME
	Delete TSIG key (warning: will not unmap key!)
tsigkey generate NAME ALGORITHM
	Generate new TSIG key.
	ALGORITHM is one of hmac-{md5,sha1,sha224,sha256,sha384,sha512}
tsigkey import NAME ALGORITHM KEY
	Import TSIG key
tsigkey list
	List all TSIG keys

Views Commands:

view add-zone VIEW ZONE..VARIANT
	Add a zone variant to a view
view del-zone VIEW ZONE..VARIANT
	Remove a zone variant from a view
view list
	List all zones within VIEW
view list-all
	List all view names

Zone Commands:

zone check ZONE
	Check a zone for correctness
zone check-all [exit-on-error]
	Check all zones for correctness. Use exit-on-error to exit immediately
	upon finding the first error in any zone
zone clear ZONE
	Clear all records of a zone, but keep everything else
zone create ZONE [NSNAME]
	Create empty zone ZONE
zone delete ZONE
	Delete zone ZONE
zone edit ZONE
	Edit zone contents using $EDITOR
zone increase-serial ZONE
	Increases the SOA-serial by 1. Uses SOA-EDIT
zone list ZONE
	List zone contents
zone list-all [primary|secondary|native|producer|consumer]
	List all active zone names.
	Use --verbose (-v) to include disabled or empty zones
zone load ZONE FILENAME [ZONE FILENAME]...
	Load ZONE from FILENAME, possibly creating zone or atomically replacing
	contents; --verbose or -v will also include the keys for disabled or
	empty zones
zone set-account ZONE ACCOUNT
	Change the account (owner) of ZONE to ACCOUNT
zone set-kind ZONE KIND
	Change the kind of ZONE to KIND (primary, secondary, native, producer,
	or consumer)
zone set-option ZONE [producer|consumer] [coo|unique|group] VALUE [VALUE...]
	Set or remove an option for ZONE. Providing an empty value removes the
	option
zone set-options-json ZONE JSONFILE
	Change the options of ZONE to JSONFILE
zone show ZONE
	Show various details about a zone, including DNSSEC keys
zone zonemd-verify-file ZONE FILENAME
	Validate ZONEMD for ZONE

Secondary Zone Commands:

zone change-primary ZONE PRIMARY_IP [PRIMARY_IP...]
	Change secondary zone ZONE primary IP address(es) to PRIMARY_IP
zone create-secondary ZONE PRIMARY_IP [PRIMARY_IP...]
	Create secondary zone ZONE with primary IP address(es) PRIMARY_IP

DNSSEC Commands:

zone dnssec-disable ZONE
	Deactivate all keys and unset PRESIGNED in ZONE
zone export-dnskey ZONE KEY_ID
	Export the public DNSKEY with the given ID to stdout
zone export-ds ZONE
	Export all KSK DS records for ZONE to stdout
zone list-keys [ZONE]
	List DNSSEC keys for ZONE.
	When ZONE is unset, display keys for all active zones
zone rectify ZONE [ZONE...]
	Fix up DNSSEC fields (order, auth)
zone rectify-all [quiet]
	Rectify all zones. Optionally quiet output with errors only
zone secure ZONE [ZONE...]
	Add DNSSEC to zone ZONE
zone secure-all [increase-serial]
	Secure all zones without keys
zone set-nsec3 ZONE ['PARAMS' [narrow]]
	Enable NSEC3 with PARAMS (default: '1 0 0 -'). Optionally narrow
zone set-presigned ZONE
	Use presigned RRSIGs from storage
zone set-publish-cdnskey ZONE [delete]
	Enable sending CDNSKEY responses for ZONE. Add 'delete' to publish
	a CDNSKEY with a DNSSEC delete algorithm
zone set-publish-cds ZONE [DIGESTALGOS]
	Enable sending CDS responses for ZONE, using DIGESTALGOS as signature
	algorithms; DIGESTALGOS should be a comma-separated list of numbers,
	(default: '2')
zone set-signaling ZONE
	Configure zone for RFC 9615 DNSSEC bootstrapping
	(zone name must begin with _signal.)
zone unset-nsec3 ZONE
	Switch ZONE back to NSEC
zone unset-presigned ZONE
	Stop using presigned RRSIGs on ZONE
zone unset-publish-cdnskey ZONE
	Disable sending CDNSKEY responses for ZONE
zone unset-publish-cds ZONE
	Disable sending CDS responses for ZONE

Zone Key Commands:

zone activate-key ZONE KEY_ID
	Activate the key with key id KEY_ID in ZONE
zone add-key ZONE [zsk|ksk] [BITS] [active|inactive] [published|unpublished]
    [rsasha1|rsasha1-nsec3-sha1|rsasha256|rsasha512|ecdsa256|ecdsa384|ed25519|ed448]
	Add a ZSK or KSK to zone with specific algorithm and size in bits.
	If zsk or ksk is omitted, defaults to zsk
zone deactivate-key ZONE KEY_ID
	Deactivate the key with key id KEY_ID in ZONE
zone export-key ZONE KEY_ID
	Export the private key with the given ID to stdout
zone export-key-pem ZONE KEY_ID
	Export the private key with the given ID to stdout in PEM format
zone generate-key {zsk|ksk} [ALGORITHM] [BITS]
	Generate a ZSK or KSK to stdout with specified ALGORITHM and BITS
zone import-key ZONE FILE [active|inactive] [ksk|zsk] [published|unpublished]
	Import from a file a private key, ZSK or KSK; defaults to KSK, active
	and published
zone import-key-pem ZONE FILE ALGORITHM [ksk|zsk]}
	Import a private key from a PEM file
zone publish-key ZONE KEY_ID
	Publish the zone key with key id KEY_ID in ZONE
zone remove-key ZONE KEY_ID
	Remove key with KEY_ID from ZONE
zone unpublish-key ZONE KEY_ID
	Unpublish the zone key with key id KEY_ID in ZONE

Other/Miscellaneous Commands:

b2b-migrate OLD NEW
	Move all data from one backend to another
backend-cmd BACKEND CMD [CMD...]
	Perform one or more backend commands
backend-lookup BACKEND NAME [[TYPE] CLIENT_IP_SUBNET]
	Perform a backend lookup of NAME, TYPE (defaulting to ANY) and
	CLIENT_IP_SUBNET
bench-db [FILENAME]
	Benchmark database backend with queries, one zone per line
create-bind-db FILENAME
	Create DNSSEC db for BIND backend (bind-dnssec-db)
hash-password [WORK FACTOR]
	Ask for a plaintext password or API key and output a salted and hashed
	version
ipdecrypt IP_ADDRESS PASSPHRASE_OR_KEY [key]
	Decrypt IP address using passphrase or base64 key
ipencrypt IP_ADDRESS PASSPHRASE_OR_KEY [key]
	Encrypt IP address using passphrase or base64 key
list-algorithms [with-backend]
	List all DNSSEC algorithms supported, optionally also listing the
	cryptographic library used
lmdb-get-backend-version
	Get schema version supported by backend
raw-lua-from-content TYPE CONTENT
	Display record contents in a form suitable for dnsdist's
	`SpoofRawAction`
test-schema ZONE
	Test DB schema - will create ZONE

Common options:
  -h [ --help ]            produce help message
  --version                show version
  -v [ --verbose ]         be verbose
  -f [ --force ]           force an action
  -q [ --quiet ]           be quiet
  --config-name arg        virtual configuration name
  --config-dir arg (=/etc) location of pdns.conf
  --no-colors              do not use colors in output
  --commands arg