PDNSSEC(8)

NAME
pdnssec - PowerDNSSEC command and control

SYNOPSIS
pdnssec [options] command

DESCRIPTION
pdnssec is a powerful command that is the operator-friendly gateway into PowerDNSSEC configuration. Behind the scenes, pdnssec manipulates a PowerDNS backend database, which also means that for many databases, pdnssec can be run remotely, and can configure key material on different servers.

OPTIONS
A summary of options is included below.

-h [ --help ]
    Show summary of options.

-v [ --verbose ]
    Be more verbose.

--force
    force an action

--config-name arg
    Virtual configuration name

--config-dir arg (=/etc/powerdns)
    Location of pdns.conf

--commands arg
    Commands given as an argument

COMMANDS

activate-zone-key ZONE KEY-ID
    Activate a key with id KEY-ID within a zone called ZONE.

add-zone-key ZONE [zsk|ksk] [bits] [rsasha1|rsasha256|rsasha512|gost|ecdsa256|ecdsa384]
    Create a new key for zone ZONE, and make it a KSK or a ZSK, with the specified algorithm.

check-zone ZONE
    Check a zone for correctness

deactivate-zone-key ZONE KEY-ID
    Deactivate a key with id KEY-ID within a zone called ZONE.

disable-dnssec ZONE
    Deactivate all keys and unset PRESIGNED in ZONE

export-zone-dnskey ZONE KEY-ID
    Export to standard output DNSKEY and DS of key with key id KEY-ID within zone called ZONE.

export-zone-key ZONE KEY-ID
    Export to standard output full (private) key with key id KEY-ID within zone called ZONE. The format used is compatible with BIND and NSD/LDNS.

hash-zone-record ZONE RNAME
    This convenience command hashes the name 'recordname' according to the NSEC3 settings of ZONE. Refuses to hash for zones with no NSEC3 settings.

import-zone-key ZONE FILE [ksk|zsk]
    Import from 'filename' a full (private) key for zone called ZONE. The format used is compatible with BIND and NSD/LDNS. KSK or ZSK specifies the flags this key should have on import.

rectify-zone ZONE
    Calculates the 'ordername' and 'auth' fields for a zone called ZONE so they comply with DNSSEC settings. Can be used to fix up migrated data. Can always safely be run, it does no harm.

remove-zone-key ZONE KEY-ID
    Remove a key with id KEY-ID from a zone called ZONE.

secure-zone ZONE
    Configures a zone called ZONE with reasonable DNSSEC settings. You should manually run 'pdnssec rectify-zone' afterwards.

set-nsec3 ZONE 'params' [narrow]
    Sets NSEC3 parameters for this zone. A sample commandline is: "pdnssec set-nsec3 powerdnssec.org '1 1 1 ab' narrow". The NSEC3 parameters must be quoted on the command line.
    WARNING:
    If running in RSASHA1 mode (algorithm 5 or 7), switching from NSEC to NSEC3 will require a DS update at the parent zone!

set-presigned ZONE
    Switches zone to presigned operation, utilizing in-zone RRSIGs.

show-zone ZONE
    Shows all DNSSEC related settings of a zone called ZONE.

unset-nsec3 ZONE
    Converts a zone to NSEC operations.
    WARNING:
    If running in RSASHA1 mode (algorithm 5 or 7), switching from NSEC to NSEC3 will require a DS update at the parent zone!

unset-presigned ZONE
    Disables presigned operation for ZONE.

AUTHOR
This manual page was written by Matthijs Möhlmann <matthijs@cacholong.nl> for the Debian Project (but may be used by others)

SEE ALSO
pdns_server(8),pdns_control(8)