DNSSEC-KEYFROMLABEL(1) BIND 9 DNSSEC-KEYFROMLABEL(1) (NAME) dnssec-keyfromlabel - DNSSEC (SYNOPSIS) dnssec-keyfromlabel {-l label} [-3] [-a algorithm] [-A date/offset] [-c class] [-D date/offset] [-D sync date/offset] [-E engine] [-f flag] [-G] [-I date/offset] [-i interval] [-k] [-K directory] [-L ttl] [-M tag_min:tag_max] [-n nametype] [-P date/offset] [-P sync date/offset] [-p protocol] [-R date/offset] [-S key] [-t type] [-v level] [-V] [-y] {name} (DESCRIPTION) dnssec-keyfromlabel (HSM) . DNSSEC dnssec-keygen <#std-iscman-dnssec-keygen> HSM . (name) . . (OPTIONS) -a algorithm . algorithm RSASHA1 () NSEC3RSASHA1 () RSASHA256 RSASHA512 ECDSAP256SHA256 ECDSAP384SHA384 ED25519 ED448 . . ECDSA256 ECDSAP256SHA256 ECDSA384 ECDSAP384SHA384 . RSASHA1 () -3 NSEC3RSASHA1 () . -S . 9.12.0: RSASHA1 () . -3 NSEC3 DNSSEC . NSEC NSEC3 NSEC3 dnssec-keygen -3a RSASHA1 NSEC3RSASHA1 () . -E engine . BIND 9 OpenSSL OpenSSL ( pkcs11) . -l label . BIND 9 PKCS#11 OpenSSL . OpenSSL pkcs11:keylabel. -n nametype . nametype ZONE ( DNSSEC KEY/DNSKEY) HOST ENTITY ( KEY) USER ( KEY) OTHER ( DNSKEY) . . -C . dnssec-keyfromlabel . BIND -C . -c class DNS . IN . -f flag flag KEY/DNSKEY . KSK (Key-Signing Key) REVOKE . -G . -P -A . -h dnssec-keyfromlabel . -K directory . -k DNSKEY KEY . -L ttl TTL RR DNSKEY . TTL DNSKEY RRset TTL . TTL 0 none . -M tag_min:tag_max (key tag) dnssec-keyfromlabel . . (multi-signer) . tag_min tag_max [0..65535] . . -p protocol . 0 255 . 3 (DNSSEC) . RFC 2535 . -S key . . . . -t type . type AUTHCONF NOAUTHCONF NOAUTH NOCONF . AUTHCONF . AUTH CONF . -v level . -V . -y DNSSEC (key ID) . ( RFC 5011 .) (TIMING OPTIONS) YYYYMMDD YYYYMMDDHHMMSS ( ) 'Day Mon DD HH:MM:SS YYYY' ( dnssec-settime -p ) (UNIX epoch time) ( dnssec-settime -up ) now . + - () . now . y mo w d h mi ( ) ( ) . . none never unset . . -P date/offset . . -G . sync date/offset CDS CDNSKEY . -A date/offset . . -G . -R date/offset . . . -I date/offset . . -D date/offset . . ( .) sync date/offset CDS CDNSKEY . -i interval . . . . y mo w d h mi . . (GENERATED KEY FILES) dnssec-keyfromlabel Knnnn.+aaa+iiiii . . o nnnn . o aaa . o iiiii ( / footprint) . dnssec-keyfromlabel . Knnnn.+aaa+iiiii.key Knnnn.+aaa+iiiii.private . .key DNS KEY ( $INCLUDE). .private . . (SEE ALSO) dnssec-keygen(8) <#std-iscman-dnssec-keygen>, dnssec-signzone(8) <#std- iscman-dnssec-signzone>, BIND 9 Administrator Reference Manual, RFC 4034 , RFC 7512 . (AUTHORS) Internet Systems Consortium (COPYRIGHT) 2026, Internet Systems Consortium 9.20.27 2026-08-19 DNSSEC-KEYFROMLABEL(1)