dnssec-dsfromkey — DNSSEC DS RR generation tool
dnssec-dsfromkey  [ -1  |   -2  |   -a  ] [ alg-C  |   -l  ] [domain-T ] [TTL-v ] [level-K ] {keyfile}directory
dnssec-dsfromkey  [ -1  |   -2  |   -a  ] [ alg-C  |   -l  ] [domain-T ] [TTL-v ] [level-c ] [class-A] {-f } [dnsname]file
dnssec-dsfromkey  [ -1  |   -2  |   -a  ] [ alg-C  |   -l  ] [domain-T ] [TTL-v ] [level-c ] [class-K ] {-s} {dnsname}directory
dnssec-dsfromkey  [ -h  |   -V ]
      The dnssec-dsfromkey command outputs DS (Delegation
      Signer) resource records (RRs) and other similarly-constructed RRs:
      with the -l option it outputs DLV (DNSSEC Lookaside
      Validation) RRs; or with the -C it outputs CDS (Child
      DS) RRs.
    
The input keys can be specified in a number of ways:
      By default, dnssec-dsfromkey reads a key file
      named like Knnnn.+aaa+iiiii.key, as generated
      by dnssec-keygen.
    
      With the -f 
      option, dnssec-dsfromkey reads keys from a zone file
      or partial zone file (which can contain just the DNSKEY records).
    file
      With the -s
      option, dnssec-dsfromkey reads
      a keyset- file, as generated
      by dnssec-keygen -C.
    
	    An abbreviation for -a SHA1
	  
	    An abbreviation for -a SHA-256
	  
algorithmSpecify a digest algorithm to use when converting DNSKEY records to DS records. This option can be repeated, so that multiple DS records are created for each DNSKEY record.
	    The algorithm must be one of
	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
	    and the hyphen may be omitted.  If no algorithm is specified,
	    the default is to use both SHA-1 and SHA-256.
	  
            Include ZSKs when generating DS records. Without this option, only
            keys which have the KSK flag set will be converted to DS records
            and printed. Useful only in -f zone file mode.
          
class
	    Specifies the DNS class (default is IN). Useful only
	    in -s keyset or -f
	    zone file mode.
	  
	    Generate CDS records rather than DS records. This is mutually
	    exclusive with the -l option for generating DLV
	    records.
	  
file
	    Zone file mode: dnssec-dsfromkey's
	    final dnsname argument is
	    the DNS domain name of a zone whose master file can be read
	    from file.  If the zone name is the same as
	    file, then it may be omitted.
	  
	    If file is "-", then
	    the zone data is read from the standard input.  This makes it
	    possible to use the output of the dig
	    command as input, as in:
	  
	    dig dnskey example.com | dnssec-dsfromkey -f - example.com
	  
Prints usage information.
directory
	    Look for key files or keyset- files in
	    directory.
	  
domain
	    Generate a DLV set instead of a DS set. The specified
	    domain is appended to the name for each
	    record in the set.
	    This is mutually exclusive with the -C option
	    for generating CDS records.
	  
	    Keyset mode: dnssec-dsfromkey's
	    final dnsname argument is the DNS
	    domain name used to locate a keyset- file.
	  
TTLSpecifies the TTL of the DS records. By default the TTL is omitted.
levelSets the debugging level.
Prints version information.
      To build the SHA-256 DS RR from the
      Kexample.com.+003+26160
      keyfile name, you can issue the following command:
    
dnssec-dsfromkey -2 Kexample.com.+003+26160
    
The command would print something like:
example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94
    
BIND 9.11.36 (Extended Support Version)