PDNSUTIL(1) PowerDNS Authoritative Server PDNSUTIL(1) (NAME) pdnsutil - DNSSEC PowerDNS (SYNOPSIS) pdnsutil [OPTION]... COMMAND (DESCRIPTION) pdnsutil ( pdnssec) (zone) DNSSEC PowerDNS . pdnsutil backend PowerDNS pdnsutil . (OPTIONS) -h, --help -v, --verbose -f, --force -q, --quiet -s, --sort --config-name --config-dir pdns.conf. /etc/powerdns . (COMMANDS) . pdnsutil [arguments...] . AUTOPRIMARY (AUTOPRIMARY COMMANDS) autoprimary add IP NAMESERVER [ACCOUNT] autoprimary backend. . autoprimary list autoprimary. autoprimary remove IP NAMESERVER autoprimary backend. backend BIND . catalog list-members CATALOG CATALOG. catalog set ZONE [CATALOG] ZONE CATALOG. CATALOG ZONE . (ZONE METADATA COMMANDS) metadata add ZONE KIND VALUE [VALUE]... VALUE KIND ZONE. KIND metadata set . metadata get ZONE [KIND]... . KIND . metadata set ZONE KIND [VALUE]... KIND ZONE VALUE KIND . . (NETWORK COMMANDS) network list (views) . network set NET [VIEW] VIEW NET VIEW . (ZONE RECORD COMMANDS) rrset record . rrset add ZONE NAME TYPE [TTL] CONTENT NAME TYPE ZONE CONTENT TTL. TTL default-ttl . NAME (absolute) . rrset delete ZONE NAME TYPE RRSET . NAME . rrset hash ZONE RNAME RNAME NSEC3 ZONE . NSEC3 . rrset replace ZONE NAME TYPE [TTL] CONTENT [CONTENT...] NAME ZONE . TSIG . ALGORITHM : o hmac-md5 o hmac-sha1 o hmac-sha224 o hmac-sha256 o hmac-sha384 o hmac-sha512 tsigkey activate ZONE NAME {primary,secondary,producer,consumer} AXFR TSIG NAME ZONE. TSIG-ALLOW-AXFR ( primary/producer) AXFR-MASTER-TSIG ( secondary/consumer) . tsigkey deactivate ZONE NAME {primary,secondary,producer,consumer} AXFR TSIG NAME ZONE. tsigkey delete NAME TSIG NAME. : . tsigkey generate NAME ALGORITHM TSIG NAME . tsigkey import NAME ALGORITHM KEY KEY NAME. tsigkey list TSIG . (VIEWS COMMANDS) views add-zone VIEW ZONE..VARIANT ZONE VARIANT VIEW. views del-zone VIEW ZONE..VARIANT ZONE VARIANT VIEW. views list VIEW VIEW. views list-all (views). zone check ZONE ZONE. zone check-all [exit-on-error] "exit-on-error" . zone clear ZONE ZONE . zone copy ZONE NEW-ZONE ZONE ( ) NEW-ZONE. backend ZONE . zone create ZONE ZONE. zone delete ZONE ZONE. zone edit ZONE ZONE zonefile ( backend ) EDITOR. EDITOR pdnsutil editor . zone increase-serial ZONE SOA-serial . SOA-EDIT . zone list ZONE ZONE. --sort -s . zone list-all KIND (KIND) (primary secondary native producer consumer) . --verbose -v . zone load ZONE FILE ZONE FILE. ZONE (atomic) . ZONE . zone set-account ZONE ACCOUNT () ZONE ACCOUNT. zone set-kind ZONE KIND ZONE KIND ( primary secondary native producer consumer). zone set-option ZONE [producer | consumer] [coo | unique | group] VALUE [VALUE ...] ZONE. . zone set-options-json ZONE JSONFILE ZONE JSONFILE. zone zonemd-verify-file ZONE FILE ZONEMD ZONE FILE. zone change-primary ZONE PRIMARY [PRIMARY]... ZONE PRIMARY. PRIMARY IP . zone create-secondary ZONE PRIMARY [PRIMARY]... ZONE PRIMARY. PRIMARY IP . DNSSEC (DNSSEC-RELATED COMMANDS) DNSSEC . ALGORITHM . : o rsasha1 o rsasha1-nsec3-sha1 o rsasha256 o rsasha512 o ecdsa256 o ecdsa384 o ed25519 o ed448 ed25519 ed448 PowerDNS . . ECC ECDSA256 ED25519 256 ECDSA384 384 ED448 ... 456 . zone dnssec-disable ZONE PRESIGNED ZONE. zone export-dnskey ZONE KEY_ID DNSKEY DS KEY_ID ZONE . zone export-ds ZONE KSK DS ZONE . zone list-keys [ZONE] DNSSEC ZONE. --verbose -v . zone rectify ZONE 'ordername' 'auth' ZONE DNSSEC . . zone rectify-all 'ordername' 'auth' DNSSEC . . zone secure ZONE ZONE DNSSEC . 'pdnsutil zone rectify' . zone secure-all [increase-serial] DNSSEC . increase-serial . 'pdnsutil zone rectify-all' . zone set-nsec3 ZONE ['HASH-ALGORITHM FLAGS ITERATIONS SALT'] [narrow] NSEC3 . NSEC3PARAM NSEC3 . NSEC3 . HASH-ALGORITHM 1 (SHA-1) . FLAGS 1 NSEC3 opt-out . . ITERATIONS RFC 5155 . resolver max-nsec3-iterations pdns.conf . SALT salt - salt. narrow PowerDNS (zone enumeration) << >> (RFC 7129) . hash + 1 . narrow (online signing) nameserver (zone transfers) . '1 0 0 -' RFC 9276 . : pdnsutil zone set-nsec3 powerdnssec.org '1 1 1 ab' narrow : RSASHA1 ( 5 7) NSEC NSEC3 DS (parent zone) . zone set-presigned ZONE ZONE RRSIG . zone set-publish-cdnskey ZONE [delete] ZONE CDNSKEY. 'delete' CDNSKEY DNSSEC . zone set-publish-cds ZONE [DIGESTALGOS] ZONE CDS . DIGESTALGOS DS . 2 (SHA-256) . 0 CDS DNSSEC . zone show ZONE ZONE DNSSEC . zone unset-nsec3 ZONE ZONE NSEC . : RSASHA1 ( ) NSEC NSEC3 DS (parent zone) ! zone unset-presigned ZONE (presigned) ZONE . zone unset-publish-cdnskey ZONE ZONE CDNSKEY . zone unset-publish-cds ZONE ZONE CDS . (ZONE KEY COMMANDS) zone activate-key ZONE KEY_ID KEY_ID ZONE. zone add-key ZONE [KSK,ZSK] [active,inactive] [published,unpublished] ALGORITHM [KEYBITS] ZONE KSK () ZSK ALGORITHM KEYBITS . KEYBITS default-ksk-size default-zsk-size . active ZONE . unpublished DNSKEY (algorithm rollover) . . zone deactivate-key ZONE KEY_ID KEY_ID ZONE. zone export-key ZONE KEY_ID () KEY_ID ZONE . BIND NSD/LDNS . zone export-key-pem ZONE KEY_ID () KEY_ID ZONE PEM. -DNS . zone generate-key {KSK,ZSK} [ALGORITHM] [KEYBITS] ZSK KSK . ALGORITHM ECDSA256 . KEYBITS ALGORITHM : RSA KSK ZSK ECC . zone import-key ZONE FILE [KSK,ZSK] [active,inactive] [published,unpublished] () FILE ZONE. BIND NSD/LDNS . KSK ZSK . KSK (active) (published) . . zone import-key-pem ZONE FILE ALGORITHM {KSK,ZSK} () FILE PEM ZONE ALGORITHM . -DNS . KSK ZSK . . zone publish-key ZONE KEY_ID KEY_ID ZONE. zone remove-key ZONE KEY_ID KEY_ID ZONE. zone unpublish-key ZONE KEY_ID KEY_ID ZONE. b2b-migrate OLD NEW backend . launch=OLD,NEW . backend-cmd BACKEND CMD [CMD...] backend . backend GSQL SQL backend . ! backend-lookup BACKEND NAME [TYPE [CLIENT_IP_SUBNET]] backend. bench-db [FILE] (benchmark) backend. FILE zone . FILE powerdns.com . create-bind-db FILENAME DNSSEC ( sqlite3) FILENAME backend BIND. bind-dnssec-db=*FILE* pdns.conf . hash-password [WORK_FACTOR] ( ) (hashed) (salted) api . scrypt 1024 . ipdecrypt IP_ADDRESS PASSPHRASE_OR_KEY [key] IP 'ipcipher'. base64 "key" . ipencrypt IP_ADDRESS PASSPHRASE_OR_KEY [key] IP 'ipcipher'. base64 "key" . list-algorithms [with-backend] DNSSEC "with-backend" . test-schema ZONE (schema) ZONE . raw-lua-from-content TYPE CONTENT SpoofRawAction dnsdist. pdns_server (1), pdns_control (1) (AUTHORS) PowerDNS.COM BV (COPYRIGHT) PowerDNS.COM BV August 5, 2026 PDNSUTIL(1)