NSUPDATE(1) BIND 9 NSUPDATE(1) (NAME) nsupdate - (DNS) (SYNOPSIS) nsupdate [-d] [-D] [-i] [-L level] [ [-g] | [-o] | [-l] | [-y [hmac:]keyname:secret] | [-k keyfile] ] [ [-S] [-K tlskeyfile] [-E tlscertfile] [-A tlscafile] [-H tlshostname] [-O] ] [-t timeout] [-u udptimeout] [-r udpretries] [-v] [-T] [-P] [-V] [ [-4] | [-6] ] [filename] (DESCRIPTION) nsupdate (Dynamic DNS Update) RFC 2136 . (Zone File) (Resource Records) . . nsupdate DHCP . . nsupdate . (Primary Server) MNAME SOA . (Transaction Signatures) DNS . TSIG RFC 2845 SIG(0) RFC 2535 RFC 2931 GSS-TSIG RFC 3645 . TSIG (Shared Secret) nsupdate . key server /etc/named.conf IP TSIG . ddns-confgen <#std-iscman-ddns-confgen> . nsupdate -y -k TSIG . SIG(0) . SIG(0) KEY . GSS-TSIG (Kerberos Credentials) . GSS-TSIG -g . GSS-TSIG -o . (OPTIONS) -4 IPv4 . -6 IPv6 . -A tlscafile (CA) ( PEM) TLS DNS-over-TLS (DoT) TLS (Mutual TLS) . -S . -O -S . -C resolv.conf . . -d (Debug Mode) . -D (Extra Debug Mode) . -E tlscertfile () DNS-over-TLS (DoT) . PEM . -S -K . -g GSS-TSIG . -H tlshostname nsupdate TLS . DNS . -S . -i . -k keyfile TSIG . : key named.conf <#std-iscman-named.conf> ddns-confgen <#std- iscman-ddns-confgen> K{name}.+157.+{random}.key K{name}.+157.+{random}.private dnssec-keygen <#std-iscman-dnssec-keygen> . -k SIG(0) DNS . HMAC-MD5 . -K tlskeyfile DNS-over-TLS (DoT) . PEM . -S -E . -l -- (Local-host only) localhost ( server ). TSIG /var/run/session.key primary update-policy local named <#std-iscman-named> . -k . -L level (Logging Debug Level) . . -o . GSS-TSIG . -g . -O TLS (Opportunistic TLS) . TLS . . -A -S . -p port . . -P BIND nsupdate . -T . -r udpretries UDP . . . -S server servername port SOA DNS-over-TLS (DoT) . -K -E TLS (Mutual TLS) . -v . -t timeout . . TCP . UDP -u -u -t UDP . UDP -t -u . -T IANA nsupdate . nsupdate . -T -P . TYPEXXXXX XXXXX . rdata rdata ( ) . -u udptimeout UDP . . UDP . -v TCP . nsupdate UDP UDP TCP . TCP . -V . -y [hmac:]keyname:secret TSIG . keyname secret Base64 . hmac : hmac-md5 hmac-sha1 hmac-sha224 hmac-sha256 hmac-sha384 hmac-sha512. hmac hmac-md5 MD5 hmac-sha256 . : -y . ps1 (History) . (INPUT FORMAT) nsupdate filename . . . (RRset) . . . . . ( send) DNS . : server servername port servername . nsupdate . MNAME SOA . port servername . DNS . : GSS-TSIG . local address port address . nsupdate . port . . zone zonename zonename . zone nsupdate . class classname . class IN . ttl seconds (Time-to-Live) . none . key hmac:keyname secret keyname-secret TSIG . hmac . hmac-md5 MD5 hmac-sha256 . key -y -k . gsstsig GSS-TSIG . -g . oldgsstsig . nsupdate GSS-TSIG . gsstsig . realm [realm_name] GSS-TSIG realm_name (Realm) krb5.conf . . check-names [boolean] (check-names) . . . UPDATE . check-svbc [boolean] check-svcb . . check-svcb . check-svcb UPDATE . lease time [keytime] EDNS Update Lease (UL) time keytime . time none . prereq nxdomain domain-name domain-name . prereq yxdomain domain-name domain-name ( ). prereq nxrrset domain-name class type type class domain-name . class IN () . prereq yxrrset domain-name class type type class domain-name . class IN () . prereq yxrrset domain-name class type data data type class domain-name . type class domain-name . data RDATA . RDATA ( APL rdata ) \# 0 . update delete domain-name ttl class type data domain-name . type data . class . ttl . RDATA ( APL rdata ) \# 0 . update add domain-name ttl class type data ttl class data . RDATA ( APL rdata ) \# 0 . show (send) . send . . answer . debug . version . help . (;) (Comment) . (EXAMPLES) nsupdate example.com . example.com . # nsupdate > update delete oldhost.example.com A > update add newhost.example.com 86400 A 172.16.1.1 > send A oldhost.example.com A newhost.example.com 172.16.1.1 . TTL ( ) . # nsupdate > prereq nxdomain nickname.example.com > update add nickname.example.com 86400 CNAME somehost.example.com > send nickname.example.com . . CNAME . CNAME RFC 1034 CNAME . ( DNSSEC RFC 2535 CNAME RRSIG DNSKEY NSEC .) (FILES) /etc/resolv.conf . /var/run/session.key TSIG - . K{name}.+157.+{random}.key Base-64 HMAC-MD5 dnssec-keygen <#std- iscman-dnssec-keygen>. K{name}.+157.+{random}.private Base-64 HMAC-MD5 dnssec-keygen <#std- iscman-dnssec-keygen>. (SEE ALSO) RFC 2136 RFC 3007 RFC 2104 RFC 2845 RFC 1034 RFC 2535 RFC 2931 named(8) <#std- iscman-named> dnssec-keygen(8) <#std-iscman-dnssec-keygen> tsig-keygen(8) <#std-iscman-tsig-keygen>. (BUGS) TSIG . nsupdate DST . (AUTHOR) (Internet Systems Consortium) (COPYRIGHT) 2026, Internet Systems Consortium 9.20.27 2026-08-19 NSUPDATE(1)