Which of the following utilities is used to generate keys for DNSSEC?

Question

Options

• Adnssec-dsfromkey
• Brndc
• Cdelv
• Ddnssec-keygen

• B
  3% (1)
• C
  3% (1)
• D
  95% (36)

Explanation

dnssec-keygen is the dedicated BIND utility for generating cryptographic key pairs (public and private) used in DNSSEC signing - the name itself encodes its purpose: "DNSSEC key generation."

Why the distractors are wrong:

• A. dnssec-dsfromkey - generates DS (Delegation Signer) records from an existing key; it operates on keys but does not create them.
• B. rndc - the Remote Name Daemon Control tool; used to manage and communicate with a running named process, not for cryptographic operations.
• C. delv - a DNS lookup and validation tool (think: dig with DNSSEC validation); it queries and verifies records, it doesn't generate keys.

Memory tip: The suffix -keygen is a direct giveaway - just like ssh-keygen generates SSH keys, dnssec-keygen generates DNSSEC keys. If you see "keygen" in a DNSSEC utility name, it's the answer for creating keys.

No community discussion yet for this question.