DNSSEC-KEYGEN(1) BIND 9 DNSSEC-KEYGEN(1) (NAME) dnssec-keygen - DNSSEC (SYNOPSIS) dnssec-keygen [-3] [-A date/offset] [-a algorithm] [-b keysize] [-C] [-c class] [-D date/offset] [-d bits] [-D sync date/offset] [-E engine] [-f flag] [-F] [-G] [-h] [-I date/offset] [-i interval] [-K directory] [-k policy] [-L ttl] [-l file] [-n nametype] [-M tag_min:tag_max] [-P date/offset] [-P sync date/offset] [-p protocol] [-q] [-R date/offset] [-S key] [-s strength] [-T rrtype] [-t type] [-V] [-v level] {name} (DESCRIPTION) dnssec-keygen DNSSEC ( Secure DNS) RFC 2535 RFC 4034 . (name) . DNSSEC (zone) . (OPTIONS) -3 NSEC3 DNSSEC . NSEC NSEC3 NSEC3 dnssec-keygen -3 -a RSASHA1 () NSEC3RSASHA1 . -a algorithm . DNSSEC algorithm RSASHA1 () NSEC3RSASHA1 () RSASHA256 RSASHA512 ECDSAP256SHA256 ECDSAP384SHA384 ED25519 ED448 . . ECDSA256 ECDSAP256SHA256 ECDSA384 ECDSAP384SHA384. RSASHA1 () -3 NSEC3RSASHA1 () . -S (predecessor key) . HMAC TSIG BIND 9.13.0 . TSIG tsig-keygen <#std-iscman-tsig-keygen> . -b keysize . : RSA - (Diffie-Hellman) . (Elliptic curve) . . RSA DNSSEC ( ZSK) RSA (KSK -f KSK) . -C . dnssec-keygen . BIND -C . -c class DNS . IN . -d bits . RSASHA1 NSEC3RSASA1 RSASHA256 RSASHA512 DH . ECDSAP256SHA256 ECDSAP384SHA384 ED25519 ED448 . -E engine . BIND 9 OpenSSL OpenSSL ( pkcs11) . -f flag (flag) KEY/DNSKEY . ZSK ( Zone-Signing Key) KSK ( Key-Signing Key) REVOKE (). ZSK DNSKEY ZSK . -f -k . -F FIPS (FIPS) . -G . -P -A . -h dnssec-keygen . -K directory . -k policy dnssec-policy . dnssec-keygen . ".state" . dnssec-policy dnssec-keygen . -L ttl TTL (RR) DNSKEY . TTL (RRset) DNSKEY TTL . DNSKEY RRset TTL TTL SOA . TTL 0 none . -l file dnssec-policy ( -k) . -M tag_min:tag_max (key tag) dnssec-keygen . . (multi-signer) . tag_min tag_max [0..65535] . . -k policy . -n nametype . nametype ZONE ( DNSSEC KEY/DNSKEY) HOST ENTITY ( KEY) USER ( KEY) OTHER ( DNSKEY) . . DNSKEY ZONE . -p protocol -T KEY . . (DNSSEC) . RFC 2535 . -q (quiet mode) . dnssec-keygen RSA DSA stderr . . + - (Miller-Rabin) ( ) . -S key . . . . -s strength (strength) . DNSSEC . -T rrtype (RR type) . rrtype DNSKEY KEY . DNSSEC DNSKEY SIG(0) KEY . -t type -T KEY . type AUTHCONF NOAUTHCONF NOAUTH NOCONF . AUTHCONF . AUTH CONF . -V . -v level (debugging level) . (TIMING OPTIONS) YYYYMMDD YYYYMMDDHHMMSS ( ) 'Day Mon DD HH:MM:SS YYYY' ( dnssec-settime -p ) (UNIX epoch time dnssec-settime -up ) now . + - () . now . y mo w d h mi ( ) ( ) . . none never unset . -P date/offset . . -G . sync date/offset CDS CDNSKEY . -A date/offset . . -G . -P . -R date/offset (revoked) . . . -I date/offset () . . -D date/offset . ( ). sync date/offset CDS CDNSKEY . -i interval (prepublication interval) . . . . y mo w d h mi . . (GENERATED KEYS) dnssec-keygen Knnnn.+aaa+iiiii . . o nnnn . o aaa . o iiiii ( / footprint) . dnssec-keygen . Knnnn.+aaa+iiiii.key Knnnn.+aaa+iiiii.private . .key DNSKEY KEY . named <#std-iscman-named> dnssec-signzone -S <# cmdoption-dnssec-signzone-S> DNSKEY . .key $INCLUDE . .private . . (EXAMPLE) (ZSK) ECDSAP256SHA256 example.com : dnssec-keygen -a ECDSAP256SHA256 example.com : Kexample.com.+013+26160 dnssec-keygen Kexample.com.+013+26160.key Kexample.com.+013+26160.private . (KSK) : dnssec-keygen -a ECDSAP256SHA256 -f KSK example.com (SEE ALSO) dnssec-signzone(8) <#std-iscman-dnssec-signzone> BIND 9 (BIND 9 Administrator Reference Manual) RFC 2539 RFC 2845 RFC 4034 . (AUTHORS) Internet Systems Consortium (COPYRIGHT) 2026, Internet Systems Consortium 9.20.27 2026-08-19 DNSSEC-KEYGEN(1)