@@ -269,6 +269,13 @@ Specifies the TTL to be used for new DNSKEY records imported into the zone from
Print statistics at completion.
.RE
.PP
\-u
.RS 4
Update NSEC/NSEC3 chain when re\-signing a previously signed zone. With this option, a zone signed with NSEC can be switched to NSEC3, or a zone signed with NSEC3 can be switch to NSEC or to NSEC3 with different parameters. Without this option,
\fBdnssec\-signzone\fR
will retain the existing chain when re\-signing.
.RE
.PP
\-v \fIlevel\fR
.RS 4
Sets the debugging level.
...
...
@@ -292,6 +299,11 @@ When generating a NSEC3 chain use this many interations. The default is 100.
\-A
.RS 4
When generating a NSEC3 chain set the OPTOUT flag on all NSEC3 records and do not generate NSEC3 records for insecure delegations.
.sp
Using this option twice (i.e.,
\fB\-AA\fR) turns the OPTOUT flag off for all records. This is useful when using the
\fB\-u\fR
option to modify an NSEC3 chain which previously had OPTOUT set.