What it does
dnst is NLnet Labs' DNS operations toolbox, offering key, signing, notification and update commands with compatibility interfaces for selected ldns utilities.
Choose the maintenance command rather than treating the toolbox as a single DNS lookup. Its six documented commands cover key material, NSEC3 hashes, signing, notifications and updates. In the 0.2.0-alpha3 signzone manual, signing takes an explicit zone origin, a zone file and key base names; both .key and .private files must exist. Existing NSEC(3) and RRSIG records are skipped on loading, and the signed output defaults to a .signed file unless a path or standard output is selected. Publishing that output remains a separate operational step. The toolbox depends on OpenSSL. Its ldns emulation closely follows supported commands but has exceptions documented per command.
Strengths
- Several zone-maintenance tasks in one toolbox
- Compatibility and newer command interfaces
Watch out for
- Replacement scripts need command-by-command compatibility review
Sources
- NLnet Labs - domain - dnst (Oct 26, 2026)
- dnst signzone versioned input/output manual (Oct 26, 2026)
- dnst modes and OpenSSL dependency (Oct 26, 2026)