dnssec-dsfromkey

A DS is just a hash of the child's name and its key-signing key: anyone can compute it from the DNSKEY the child publishes and compare it with what the parent publishes. A mismatch is a broken chain of trust. It is also how a new DS is made for the parent after a key rollover, and how a trust anchor is checked.

dnssec-dsfromkey command usage

dnssec-dsfromkey -2 KEYFILE
dig +noall +answer DNSKEY ZONE | dnssec-dsfromkey -2 -f - ZONE

Options

-2

SHA-256 digest (type 2), the one to use

-f -

read DNSKEY records from standard input (or a zone file) instead of a key file

-K DIR

look for key files in DIR

dnssec-dsfromkey examples

dig +noall +answer DNSKEY example.lab | dnssec-dsfromkey -2 -f - example.lab

Computes example.lab's DS from the keys it publishes.

dig +noall +answer @10.0.2.10 DNSKEY . | dnssec-dsfromkey -2 -f - .

Computes the root's DS, the digest a trust anchor holds.

dnssec-dsfromkey -2 Kexample.lab.+013+12345.key

Computes the DS from a key file.

Pitfalls

• It prints a DS for every key with the SEP flag (257); a zone mid-rollover has two, and only one may match the parent's.