RNDC(8) BIND 9 RNDC(8) (NAME) rndc - (name server) (SYNOPSIS) rndc [-b source-address] [-c config-file] [-k key-file] [-s server] [-p port] [-q] [-r] [-V] [-y server_key] [[-4] | [-6]] {command} (DESCRIPTION) rndc . rndc . rndc TCP . rndc named <#std-iscman-named> HMAC-MD5 ( ) HMAC-SHA1 HMAC-SHA224 HMAC-SHA256 () HMAC-SHA384 HMAC-SHA512. TSIG . server_key . rndc . (OPTIONS) -4 IPv4 . -6 IPv6 . -b source-address source-address . IPv4 IPv6 . -c config-file config-file /etc/rndc.conf . -k key-file key-file /etc/rndc.key . /etc/rndc.key config-file . -s server server server rndc . default-server options rndc . -p port BIND 9 953 TCP port . -q . -r rndc named <# std-iscman-named> ( ISC_R_SUCCESS ISC_R_FAILURE ) . -t timeout (timeout) rndc timeout . ( ) . . -V (verbose) . -y server_key server_key . server_key named <#std-iscman-named> . server_key rndc key server server default-key options . . (COMMANDS) rndc rndc . : addzone zone [class [view]] configuration (zone) . allow-new-zones yes . named.conf <#std- iscman-named.conf> . viewname.nzf ( named <#std-iscman-named> liblmdb LMDB viewname.nzd) . viewname (view) view view . named <#std-iscman- named> view . addzone example.com : rndc addzone example.com '{ type primary; file "example.com.db"; };' ( .) rndc delzone rndc modzone. delzone [-clean] zone [class [view]] . -clean (master file) ( ) . -clean . ( secondary stub rndc delzone .) rndc addzone . named.conf <#std-iscman-named .conf> . named.conf <#std-iscman-named.conf> . rndc addzone rndc modzone. dnssec "dnssec-policy" . -checkds [-key id [-alg algorithm]] [-when time] (published | withdrawn) zone [class [view]] named <#std-iscman- named> DS (KSK) (withdrawn) . (rollover) KSK . -key id -alg algorithm KSK KSK . DS -when time time YYYYMMDDHHMMSS . -rollover -key id [-alg algorithm] [-when time] zone [class [view]] (rollover) ( ). -key id -alg algorithm . -when time time YYYYMMDDHHMMSS . . -status [-v] zone [class [view]] DNSSEC . -v . -step zone [class [view]] named <#std-iscman-named> dnssec-policy . rndc dnssec -step named <#std-iscman-named> . dnstap (-reopen | -roll [number]) DNSTAP . rndc dnstap -reopen named <#std-iscman-named> (truncate) . rndc dnstap -roll (log) (roll) . ".0" ".1" . number . dumpdb [-all | -cache | -zones | -adb | -bad | -expired | -fail] [view ...] () / . . ( dump-file BIND 9 .) fetchlimit [view] fetches-per-server fetches-per-zone . flush . flushname name [view] DNS (nameserver address database) (bad server cache) SERVFAIL . flushtree name [view] DNS SERVFAIL . freeze [zone [class [view]]] . . (master file) . . rndc thaw. halt [-p] . IXFR (roll forward) . -p (PID) named <#std-iscman-named> . named <#std- iscman-named> . rndc stop. skr -import file zone [class [view]] SKR KSK . loadkeys [zone [class [view]]] DNSSEC . DNSKEY . rndc sign . dnssec-policy . managed-keys (status | refresh | sync | destroy) [class [view]] "managed-keys" DNSSEC RFC 5011 . . o status managed-keys . o refresh managed-keys . o sync managed-keys ( managed-keys.bind viewname.mkeys) . . o destroy managed-keys . . DNSSEC . named <#std-iscman-named> . rndc reconfig named <#std- iscman-named> . . memprof [(on | off | dump)] (memory profiling) . named <#std-iscman-named> jemalloc prof:true ( MALLOC_CONF /etc/malloc.conf). prof_active:false named <#std-iscman-named> . on off jemalloc . dump named <#std-iscman-named> . jemalloc . modzone zone [class [view]] configuration . allow-new-zones yes . addzone named.conf <#std-iscman- named.conf> . rndc addzone . named.conf <#std-iscman-named.conf> . named.conf <#std-iscman-named.conf> . rndc addzone rndc delzone. notify zone [class [view]] NOTIFY . notrace . rndc trace. nta [(-class class | -dump | -force | -remove | -lifetime duration)] domain [view] (NTA) DNSSEC domain duration . named.conf <#std-iscman-named.conf> nta-lifetime . . DNSSEC ( ) . NTA ( ) named <#std-iscman-named> DNSSEC (insecure) (bogus) . NTA . NTA named <#std-iscman-named> . NTA name.nta name . NTA -remove . NTA -lifetime . TTL . NTA . lifetime -remove . -dump NTA . NTA . named <#std-iscman-named> NTA ( nta-recheck ). NTA . -force NTA NTA . -class . IN DNSSEC . -l -r -d -f -c. . (--) . querylog [(on | off)] (query logging) . . queries (channel) logging named.conf <#std-iscman-named.conf> querylog yes; options named.conf <#std-iscman-named.conf> . reconfig . rndc reload . recursing named <#std- iscman-named> (recursive) (iterative) . ( ) named . ( ) . fetches-per-zone ( ) ( ) . (: ). refresh zone [class [view]] . reload . zone [class [view]] . . reset-stats . . : recursive-high-water tcp-high-water. responselog [on | off] (response logging) . . responses channel logging named.conf <#std- iscman-named.conf> responselog yes; options named.conf <#std-iscman-named.conf> . retransfer [-force] zone [class [view]] (retransfer) . inline-signing . -force . scan rndc reconfig interface-interval . secroots [-] [view ...] ( trust-anchors managed-keys trusted-keys [ ] dnssec-validation auto) . . ( ) . - rndc . secroots named.secroots secroots-file named.conf <#std-iscman-named.conf> . rndc managed-keys. serve-stale (on | off | reset | status) [class [view]] / (stale answers) named.conf <#std-iscman-named.conf> . rndc serve-stale off named <#std-iscman-named> . rndc serve-stale reset named.conf <#std- iscman-named.conf> . rndc serve-stale status . stale-answer-ttl max-stale-ttl . showzone zone [class [view]] yes allow-new-zones . rndc addzone rndc modzone rndc delzone. sign zone [class [view]] DNSSEC ( key-directory BIND 9 ). DNSKEY . DNSKEY . . dnssec-policy . rndc loadkeys. signing [(-list | -clear keyid/algorithm | -clear all | -nsec3param (parameters | none) | -serial value) zone [class [view]] DNSSEC . DNSSEC NSEC3 DNS sig-signing-type . rndc signing -list NSEC3 . rndc signing -clear ( rndc signing -list ) . . rndc signing -nsec3param NSEC3 . NSEC3 inline-signing . NSEC3PARAM : hash algorithm flags iterations salt . hash algorithm 1 SHA-1 . flags opt-out NSEC3 0 1 . iterations NSEC3 . salt () (-) salt auto named <#std-iscman-named> salt . rndc signing -nsec3param 1 0 0 - zone salt opt-out. : salt opt-out . (DoS) . rndc signing -nsec3param none NSEC3 NSEC . rndc signing -serial value value . . (inline signed) . stats . ( statistics-file BIND 9 .) status . bind/CH ./IN (hint zone) . stop -p IXFR . -p (PID) named <# std-iscman-named> . named <#std-iscman-named> . rndc halt. sync -clean [zone [class [view]]] . "-clean" . . tcp-timeouts [initial idle keepalive advertised] tcp-initial-timeout tcp-idle-timeout tcp-keepalive-timeout tcp-advertised-timeout . . (DoS) . BIND 9 . thaw [zone [class [view]]] . . . . ixfr-from-differences . . . rndc freeze. trace [level] . level . rndc notrace. validation (on | off | status) [view ...] DNSSEC . . . zonestatus zone [class [view]] (include file) DNSSEC DNSSEC (inline signing) . rndc showzone. rndc reload retransfer zonestatus redirect . (redirect) . hint . -redirect . ( "-redirect" .) (LIMITATIONS) server_key . . (SEE ALSO) rndc.conf(5) <#std-iscman-rndc.conf>, rndc-confgen(8) <#std-iscman- rndc-confgen>, named(8) <#std-iscman-named>, named.conf(5) <#std- iscman-named.conf>, BIND 9 Administrator Reference Manual. (AUTHOR) Internet Systems Consortium (COPYRIGHT) 2026, Internet Systems Consortium 9.20.27 2026-08-19 RNDC(8)