DNSSEC-SIGNZONE(1) BIND 9 DNSSEC-SIGNZONE(1) (NAME) dnssec-signzone - DNSSEC (SYNOPSIS) dnssec-signzone [-a] [-c class] [-d directory] [-D] [-E engine] [-e end-time] [-f output-file] [-F] [-g] [-G sync-records] [-h] [-i interval] [-I input-format] [-j jitter] [-J filename] [-K directory] [-k key] [-L serial] [-M maxttl] [-N soa-serial-format] [-o origin] [-O output-format] [-P] [-Q] [-q] [-R] [-S] [-s start-time] [-T ttl] [-t] [-u] [-v level] [-V] [-X extended end-time] [-x] [-z] [-3 salt] [-H iterations] [-A] {zonefile} [key...] (DESCRIPTION) dnssec-signzone (zone) NSEC RRSIG . (delegations) ( ) keyset . (OPTIONS) -a . -c class DNS . -C (compatibility) dsset-zonename keyset-zonename dnssec-signzone . -d directory BIND 9 dsset- keyset- . -D dnssec-signzone ( RRSIG NSEC NSEC3 NSEC3PARAM) . (-S) DNSKEY . $INCLUDE . -O raw . -E engine . BIND 9 OpenSSL OpenSSL ( pkcs11) . -F FIPS FIPS ( ) . -g DS dsset- keyset- . DS . -G sync-records CDS CDNSKEY . sync-records : cdnskey cds: digest-type SHA-256 (2) SHA-384 (4) . (-S) . -J filename dnssec-signzone . -K directory DNSSEC . . -k key BIND 9 (KSK) . . -M maxttl TTL . TTL maxttl maxttl . TTL . maxttl () . max-zone-ttl named.conf <#std-iscman-named.conf> . (: -D DNSSEC .) -s start-time RRSIG . . YYYYMMDDHHMMSS 20000530144500 14:45:00 UTC . +N N . start-time ( ) . -e end-time RRSIG . start-time YYYYMMDDHHMMSS . +N (N ) now+N . end-time . end-time start-time . -X extended end-time RRSIG DNSKEY . DNSKEY KSK KSK . end-time YYYYMMDDHHMMSS . +N (N ) now+N . extended end-time end-time ( end-time ). extended end-time start-time . -f output-file . .signed . output-file - full . -h dnssec-signzone . -V . -i interval . interval ( ) . RRSIG . . end-time start-time dnssec-signzone . RRSIG . dnssec-signzone RRSIG . -I input-format . text () raw. . . -j jitter RRSIG . -- -- . jitter (jitter) . () RRSIG . -L serial "raw" "source serial" serial . ( .) -n ncpus . (CPU) . -N soa-serial-format SOA . keep () increment unixtime date. keep SOA . increment SOA RFC 1982 . unixtime SOA (Unix epoch) . date SOA YYYYMMDDNN . -o origin (origin) . . -O output-format . : text () full raw raw=N named <#std- iscman-named> . raw=N : N 0 named <#std-iscman-named> N 1 9.9.0 . 1 . -P . KSK KSK . . -Q . DNSKEY . DNSKEY . -Q dnssec-signzone . ZSK RFC 6781 4.1.1.1 ("Pre-Publish Zone Signing Key Rollover") . -q (quiet mode) . dnssec-signzone : . . -R . -Q dnssec-signzone . ZSK RFC 6781 4.1.1.2 ("Double Signature Zone Signing Key Rollover") . -S (smart signing) dnssec-signzone . . : . . ( ) . . . (sync publication) ( CDS / CDNSKEY) . (sync deletion) ( CDS / CDNSKEY) . -T ttl TTL DNSKEY . TTL SOA . -S DNSKEY . DNSKEY TTL DNSKEY TTL . TTL . -t . -u NSEC/NSEC3 . NSEC NSEC3 NSEC3 NSEC NSEC3 . dnssec-signzone . -v level (debugging level) . -x BIND 9 DNSKEY CDNSKEY CDS (KSK) (ZSK) . -z BIND 9 KSK . KSK DNSKEY . -3 salt NSEC3 (salt) . (-) NSEC3 . : -3 - . . RFC 9276 . -H iterations NSEC3 BIND 9 (iterations) . 0 . : 0 DoS (CPU- exhausting DoS) . RFC 9276 . -A NSEC3 BIND 9 OPTOUT NSEC3 NSEC3 . : . ( com.) . RFC 9276 . -AA OPTOUT . -u NSEC3 OPTOUT . zonefile . key . DNSKEY . . (EXAMPLES) example.com ECDSAP256SHA256 dnssec-keygen <#std-iscman-dnssec-keygen> (Kexample.com.+013+17247) . -S (db.example.com) . dsset DS (-g). % dnssec-signzone -g -o example.com db.example.com \ Kexample.com.+013+17247 db.example.com.signed % dnssec-signzone db.example.com.signed . zone named.conf <#std-iscman-named.conf> . . . % cp db.example.com.signed db.example.com % dnssec-signzone -o example.com db.example.com db.example.com.signed % (SEE ALSO) dnssec-keygen(8) <#std-iscman-dnssec-keygen>, BIND 9 Administrator Reference Manual, RFC 4033 , RFC 6781 . (AUTHOR) Internet Systems Consortium (COPYRIGHT) 2026, Internet Systems Consortium 9.20.27 2026-08-19 DNSSEC-SIGNZONE(1)