### Example 2: Zonefileless setup (zonefile-sync: -1, zonefile-load: none, journal-content: all)

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Zone contents are stored only in the journal. Suitable for secondary servers. Requires careful tuning of journal-size options to avoid the journal getting full.

```text
zonefile-sync: -1
zonefile-load: none
journal-content: all

```

--------------------------------

### Install Knot DNS with make install

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Run this command to install the binaries and configuration files. Non-root users may need to use sudo or su -c.

```bash
$ make install

```

--------------------------------

### Add example.org zone with a zonefile location

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Starts a transaction, sets the zone and its file location, then commits the transaction.

```bash
$ knotc conf-begin
$ knotc conf-set 'zone[example.org]'
$ knotc conf-set 'zone[example.org].file' '/var/zones/example.org.zone'
$ knotc conf-commit

```

--------------------------------

### Example configuration initialization with knotc conf-begin, conf-set, conf-diff, conf-commit

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

A complete example of initializing a configuration: begin a transaction, set server listen addresses, define a remote master server, set a template with storage and master, add a zone, show the diff, and commit. Note that some server parameters (rundir, user, pidfile, tcp-reuseport, udp-workers, tcp-workers, background-workers, listen) require a server restart to take effect.

```bash
$ knotc conf-begin
$ knotc conf-set 'server.listen' '0.0.0.0@53' '::@53'
$ knotc conf-set 'remote[master_server]'
$ knotc conf-set 'remote[master_server].address' '192.168.1.1'
$ knotc conf-set 'template[default]'
$ knotc conf-set 'template[default].storage' '/var/lib/knot/zones/'
$ knotc conf-set 'template[default].master' 'master_server'
$ knotc conf-set 'zone[example.com]'
$ knotc conf-diff
$ knotc conf-commit

```

--------------------------------

### queryacl module example

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example configuration for the 'queryacl' module, allowing queries from specified address ranges and target interface, applied per-zone.

```yaml
mod-queryacl:
  - id: default
    address: [192.0.2.73-192.0.2.90, 203.0.113.0/24]
    interface: 198.51.100

zone:
  - domain: example.com
    module: mod-queryacl/default

```

--------------------------------

### Start and inspect server directly in gdb

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Commands to start knotd under gdb with a configuration file and run it to reproduce an error, allowing direct inspection in the debugger.

```bash
$ gdb --args knotd -c /etc/knot.conf
(gdb) run
...

```

--------------------------------

### kdig: DNS over HTTPS examples

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Various DoH implementations using different servers and options.

```bash
$ kdig @1.1.1.1 +https example.com.
$ kdig @193.17.47.1 +https=/doh example.com.
$ kdig @8.8.4.4 +https +https-get example.com.
$ kdig @8.8.8.8 +https +tls-hostname=dns.google +fastopen example.com.

```

--------------------------------

### Get the primary servers for the example.com zone

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Reads the master configuration item for the example.com zone. The zone name is specified in brackets.

```bash
$ knotc conf-read 'zone[example.com].master'

```

--------------------------------

### GeoIP module configuration example

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

An example configuration for the GeoIP module, specifying a config-file, TTL, mode, GeoLite2 database file, and geodb-key for country and city.

```yaml
mod-geoip:
  - id: default
    config-file: /path/to/geo.conf
    ttl: 20
    mode: geodb
    geodb-file: /path/to/GeoLite2-City.mmdb
    geodb-key: [ country/iso_code, city/names/en ]

zone:
  - domain: example.com.
    module: mod-geoip/default

```

--------------------------------

### kdig: Get A records for example.com

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Basic query to retrieve A records for example.com using kdig.

```bash
$ kdig example.com A

```

--------------------------------

### Check zone files with knotc zone-check

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Use `knotc zone-check example.com` to validate zone files before starting the server in primary (master) mode.

```bash
$ knotc zone-check example.com

```

--------------------------------

### Statistics configuration example

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example of a statistics section configuration. The timer sets the period for writing statistics metrics to the file. The file path defaults to rundir/stats.yaml. The append option, when enabled, appends to the file instead of replacing it.

```yaml
statistics:
    timer: TIME
    file: STR
    append: BOOL

```

--------------------------------

### khost: Get A, AAAA, and MX records

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Simple lookup for example.com retrieving A, AAAA, and MX records.

```bash
$ khost example.com

```

--------------------------------

### Logging configuration example

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example of a log section configuration. The target can be stdout, stderr, syslog, or a file name. The server, control, zone, and any options set minimum severity levels for different message types. If the log section is missing, warning and more serious messages go to stderr and syslog, while info and notice go to stdout.

```yaml
log:
  - target: stdout | stderr | syslog | STR
    server: critical | error | warning | notice | info | debug
    control: critical | error | warning | notice | info | debug
    zone: critical | error | warning | notice | info | debug
    any: critical | error | warning | notice | info | debug

```

--------------------------------

### Example 4: Auto-increment SOA serial (zonefile-sync: -1, zonefile-load: difference-no-serial, journal-content: all)

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Similar to Example 3 but the server handles SOA serial automatically. Requires journal-content: all to preserve the last real SOA serial across restarts.

```text
zonefile-sync: -1
zonefile-load: difference-no-serial
journal-content: all

```

--------------------------------

### Pregenerate future ZSKs with keymgr pregenerate

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Generates ZSKs for the example.com zone for 6 months ahead. The newly-generated ZSKs remain non-published until their rollover starts.

```bash
$ keymgr -c /path/to/ZSK/side.conf example.com. pregenerate +6mo

```

--------------------------------

### Start a writing transaction with knotc zone-begin

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Opens a writing transaction on all zones or on specific zones. Use the ``--`` argument to target all zones, or list zone names to target specific zones.

```shell
$ knotc zone-begin --
$ knotc zone-begin example.com example.net

```

--------------------------------

### Start Knot DNS server as a daemon

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Starts the Knot DNS server (knotd) in the background using the -d option with a specified configuration file. When run in the foreground, no PID file is created.

```bash
$ knotd -d -c knot.conf

```

--------------------------------

### kxdpgun: Manually created queries file

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example queries file for kxdpgun, one query per line in the format 'query_name query_type [flags]'. Flags E (EDNS) and D (DNSSEC) are shown.

```text
abc6.example.com. AAAA
nxdomain.example.com. A
notzone. A
a.example.com. NS E
ab.example.com. A D
abcd.example.com. DS D

```

--------------------------------

### Simple Knot DNS configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

A minimal configuration file for Knot DNS, defining server listen addresses, a zone, and logging. Use as a base for a basic setup. The server listens on all IPv4 and IPv6 addresses on port 53, serves example.com from /var/lib/knot/zones/example.com.zone, and logs info-level messages to syslog.

```yaml
# Example of a very simple Knot DNS configuration.

server:
    listen: 0.0.0.0@53
    listen: ::@53

zone:
  - domain: example.com
    storage: /var/lib/knot/zones/
    file: example.com.zone

log:
  - target: syslog
    any: info

```

--------------------------------

### Get the list of the current zones

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Reads the zone.domain configuration item to list all configured zones.

```bash
$ knotc conf-read zone.domain

```

--------------------------------

### Show per-zone statistics with knotc zone-stats

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Use `knotc zone-stats` to display statistics for a specific zone and module. The example shows all mod-stats counters for the `example.com` zone.

```bash
$ knotc zone-stats example.com mod-stats

```

--------------------------------

### dnsproxy example configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Configures a remote server and the mod-dnsproxy module to forward queries for zones not in local.zone. Queries for local.zone are answered locally; others are forwarded to 10.0.1.1.

```yaml
remote:
  - id: hidden
    address: 10.0.1.1

mod-dnsproxy:
  - id: default
    remote: hidden
    fallback: on

template:
  - id: default
    global-module: mod-dnsproxy/default

zone:
  - domain: local.zone

```

--------------------------------

### kdig: Query SOA with TLS, certificate checks, and debug

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Gets SOA record for example.com using TLS with system certificates, hostname check, certificate pin, and debug output.

```bash
$ kdig -d @185.49.141.38 +tls-ca +tls-host=getdnsapi.net \
  +tls-pin=foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9S= soa example.com

```

--------------------------------

### Get the current server configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Reads the server configuration from the active configuration database.

```bash
$ knotc conf-read server

```

--------------------------------

### Example of reverse IPv6 address shortening in synthrecord module

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shows the default output format for reverse IPv6 address generation in the synthrecord module, which now shortens the address by default.

```text
dynamic-2620-0-b61-100--1.test. 400 IN AAAA 2620:0:b61:100::1

```

--------------------------------

### Example of non-shortened reverse IPv6 address output

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shows the previous output format for reverse IPv6 address generation, which did not shorten the address.

```text
dynamic-2620-0000-0b61-0100-0000-0000-0000-0001.test. 400 IN AAAA 2620:0:b61:100::1

```

--------------------------------

### show-offline

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Print pre-generated offline key-related records for a specified time interval. If the end timestamp is omitted, it extends to infinity; if the start timestamp is omitted, it starts from the beginning.

```APIDOC
## show-offline

### Description
Print pre-generated offline key-related records for specified time interval. If `_timestamp-to_` is omitted, it will be to infinity. If `_timestamp-from_` is omitted, it will start from the beginning.

### Syntax
`show-offline [_timestamp-from_] [_timestamp-to_]`

### Parameters
- `_timestamp-from_` (timestamp) - Optional - Start of the interval. Defaults to the beginning if omitted.
- `_timestamp-to_` (timestamp) - Optional - End of the interval. Defaults to infinity if omitted.

### Example
```
$ keymgr example.com. show-offline
```
```

--------------------------------

### Example key state log lines for automatic KSK and ZSK rollovers

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shows the log lines that hint the key state: 'public' denotes a key that will be presented as the DNSKEY record, 'ready' means CDS/CDNSKEY records were created, 'active' tells that the key is used for signing, and 'active+' is an active key undergoing a roll-over or roll-in.

```log
2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag 50613, algorithm ECDSAP256SHA256, KSK, public, active
2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active

```

--------------------------------

### dnstap example configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Configures mod-dnstap to capture all queries and responses to a sink file. The sink can be a file or a UNIX socket prefixed with 'unix:'. The file is overwritten on server startup or reload.

```yaml
mod-dnstap:
  - id: capture_all
    sink: /tmp/capture.tap

template:
  - id: default
    global-module: mod-dnstap/capture_all

```

--------------------------------

### Example 1: Keep the zone file updated (zonefile-sync: 0, zonefile-load: whole, journal-content: changes)

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Default configuration that keeps the zone file updated. The journal serves as history for IXFR. Users can check and modify the zone file, but the server may overwrite it.

```text
zonefile-sync: 0
zonefile-load: whole
journal-content: changes

```

--------------------------------

### Manage configuration transactions with knotc conf-begin, conf-abort, conf-commit

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Modifying operations require an active transaction. Only one transaction can be active at a time. Use `conf-begin` to start, `conf-abort` to cancel, and `conf-commit` to commit. A semantic check runs automatically before every commit. These operations do not work on OpenBSD.

```bash
$ knotc conf-begin
$ knotc conf-abort
$ knotc conf-commit

```

--------------------------------

### Enable core dumps and extract backtrace with gdb

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Commands to enable unlimited core dump size, reproduce the crash, and use gdb to extract a backtrace from a core dump file. The output shows gdb commands to get thread info and backtraces.

```bash
$ ulimit -c unlimited                  # Enable unlimited core dump size
$ knotd ...                            # Reproduce the crash
...
$ gdb knotd <core-dump-file>           # Start gdb on the core dump
(gdb) info threads                     # Get a summary of all threads
(gdb) thread apply all bt full         # Extract backtrace from all threads
(gdb) quit

```

--------------------------------

### Using subnets in GeoIP config-file

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example config-file entries for subnet-based responses. Clients from specified subnets receive these responses; others receive default zone records. Spaces or quotes in record data must be prefixed with a backslash.

```yaml
foo.example.com:
  - net: 10.0.0.0/24
    A: [ 192.168.1.1, 192.168.1.2 ]
    AAAA: [ 2001:DB8::1, 2001:DB8::2 ]
    TXT: "subnet\ 10.0.0.0/24"
  ...
bar.example.com:
  - net: 2001:DB8::/32
    A: 192.168.1.3
    AAAA: 2001:DB8::3
    TXT: "subnet\ 2001:DB8::/32"
...

```

--------------------------------

### Example 3: Input-only zone file (zonefile-sync: -1, zonefile-load: difference, journal-content: changes)

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

The zone file is used for manual edits and is never overwritten. DNSSEC records are stored only in the journal. The zone file's SOA serial must be higher than the current zone serial.

```text
zonefile-sync: -1
zonefile-load: difference
journal-content: changes

```

--------------------------------

### Get backtrace with pstack utility

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Command to use the pstack utility to capture a backtrace of a running knotd process and save it to a file.

```bash
$ pstack $(pidof knotd) > backtrace.txt

```

--------------------------------

### Using weighted records in GeoIP config-file

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example config-file entries for weighted record selection. Each response is randomly picked with likelihood proportional to weight over the sum of all weights. Zone records are never served.

```yaml
foo.example.com:
  - weight: 1
    CNAME: canary.foo.example.com.
  - weight: 10
    CNAME: prod1.foo.example.com.
  - weight: 10
    CNAME: prod2.foo.example.com.
...

```

--------------------------------

### generate-ksr

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Print to stdout a KeySigningRequest based on pre-generated ZSKs for a specified time period. If the start timestamp is omitted, the timestamp of the last offline records set is used, or now if no records are available.

```APIDOC
## generate-ksr

### Description
Print to stdout KeySigningRequest based on pre-generated ZSKs for specified time period. If `_timestamp-from_` is omitted, timestamp of the last offline records set is used or now if no records available.

### Syntax
`generate-ksr [_timestamp-from_] _timestamp-to_`

### Parameters
- `_timestamp-from_` (timestamp) - Optional - Start of the period. Defaults to the last offline records set timestamp or now if omitted.
- `_timestamp-to_` (timestamp) - Required - End of the period.

### Example
```
$ keymgr example.com. generate-ksr +1y
```
```

--------------------------------

### Set XDP capabilities in systemd service override

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Insert these lines into the systemd override file created by `systemctl edit knot`. They set the required capabilities for XDP mode. `CAP_SYS_RESOURCE` is needed on Linux < 5.11. All capabilities are dropped when the service starts.

```ini
[Service]
CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN CAP_SYS_ADMIN CAP_IPC_LOCK CAP_SYS_RESOURCE
AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN CAP_SYS_ADMIN CAP_IPC_LOCK CAP_SYS_RESOURCE

```

--------------------------------

### Show all configure options

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Run this command to display all available configure options.

```bash
$ ./configure --help

```

--------------------------------

### Enable RRL globally with mod-rrl configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example configuration to enable RRL globally or per zone. Sets rate-limit to 200 responses per second per flow and slip to 2, meaning approximately every other rate-limited response is sent as truncated. The global-module directive in the template enables the module globally.

```yaml
mod-rrl:
  - id: default
    rate-limit: 200   # Allow 200 resp/s for each flow
    slip: 2           # Approximately every other response slips

template:
  - id: default
    global-module: mod-rrl/default   # Enable RRL globally

```

--------------------------------

### Using geographic locations in GeoIP config-file

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example config-file entries for geographic location-based responses. Clients from specified locations receive these responses; others receive default zone records. See geodb-key for syntax and semantics.

```yaml
foo.example.com:
  - geo: "CZ;Prague"
    CNAME: cz.foo.example.com.
  - geo: "US;Las Vegas"
    CNAME: vegas.foo.example.net.
  - geo: "US;*"
    CNAME: us.foo.example.net.
...

```

--------------------------------

### Configure mod-cookies with secret-lifetime and badcookie-slip

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Example configuration that sets the Server Secret regeneration interval to 30 hours and limits responses to invalid cookies to every third query. The module is enabled globally in the default template.

```yaml
mod-cookies:
  - id: default
    secret-lifetime: 30h # The Server Secret is regenerated every 30 hours
    badcookie-slip: 3    # The server replies only to every third query with a wrong cookie

template:
  - id: default
    global-module: mod-cookies/default # Enable DNS Cookies globally

```

--------------------------------

### Run configure with default options

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Run this command to configure the build with default settings.

```bash
$ ./configure

```

--------------------------------

### kjournalprint example: print last 5 changes without colors

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shows how to use kjournalprint to display the most recent 5 changes from a journal database without colorized output. The -n (or --mono) option disables colors, and -l 5 limits the number of changes. The command requires the journal directory and zone name as arguments.

```bash
$ kjournalprint -nl 5 /var/lib/knot/journal example.com.

```

--------------------------------

### conf-init

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Initializes the configuration database. Execute as the intended user to ensure server access.

```APIDOC
## conf-init

### Description
Initialize the configuration database. If the database doesn't exist yet, execute this command as an intended user to ensure the server is permitted to access the database (e.g. sudo -u knot knotc conf-init).

### Usage
`conf-init`
```

--------------------------------

### zone-get

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Gets zone data within the transaction.

```APIDOC
## zone-get

### Description
Get zone data within the transaction.

### Parameters
#### Arguments
- **zone** (string) - Required - Zone name.
- **owner** (string) - Optional - Owner name to get.
- **type** (string) - Optional - Record type to get.

### Usage
`zone-get zone [owner [type]]`
```

--------------------------------

### zone-diff

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Gets zone changes within the transaction.

```APIDOC
## zone-diff

### Description
Get zone changes within the transaction.

### Parameters
#### Arguments
- **zone** (string) - Required - Zone name.

### Usage
`zone-diff zone`
```

--------------------------------

### zone-read

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Gets zone data that are currently being presented.

```APIDOC
## zone-read

### Description
Get zone data that are currently being presented.

### Parameters
#### Arguments
- **zone** (string) - Required - Zone name.
- **owner** (string) - Optional - Owner name to read.
- **type** (string) - Optional - Record type to read.

### Usage
`zone-read zone [owner [type]]`
```

--------------------------------

### Flush the example.com and example.org zones

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Flushes the specified zones, forcing them to be written to disk.

```bash
$ knotc zone-flush example.com example.org

```

--------------------------------

### Enable mod-onlinesign with default policy

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Zone configuration enabling the onlinesign module with the default signing policy.

```yaml
zone:
  - domain: example.com
    module: mod-onlinesign

```

--------------------------------

### Optimize XDP network queues with ethtool and renice

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

These commands help optimize XDP performance by configuring RSS hash fields, combined channels, ring sizes, and prioritizing ksoftirqd processes. Replace `<interface>` with the network interface name and `<?>` with appropriate values.

```bash
ethtool -N <interface> rx-flow-hash udp4 sdfn
ethtool -N <interface> rx-flow-hash udp6 sdfn
ethtool -L <interface> combined <?>
ethtool -G <interface> rx <?> tx <?>
renice -n 19 -p $(pgrep '^ksoftirqd/[0-9]*$')

```

--------------------------------

### Bootstrap configure with autoreconf

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Run this command in the source directory to generate the configure script when compiling from a git checkout.

```bash
$ autoreconf -i -f

```

--------------------------------

### Get the SOA record for each configured zone

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Reads the SOA record for all zones using the @ owner to denote the zone name.

```bash
$ knotc zone-read -- @ SOA

```

--------------------------------

### whoami.domain.example zone file with IPv4 nameservers

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Zone file for whoami.domain.example. It defines four nameservers with only IPv4 addresses, as required for A queries. The SOA TTL is 1 and the minimum TTL is 1.

```dns
$TTL 1

@       SOA     (
                        whoami.domain.example.          ; MNAME
                        hostmaster.domain.example.      ; RNAME
                        2016051300                      ; SERIAL
                        86400                           ; REFRESH
                        86400                           ; RETRY
                        86400                           ; EXPIRE
                        1                               ; MINIMUM
                )

$TTL 86400

@       NS      ns1.whoami.domain.example.
@       NS      ns2.whoami.domain.example.
@       NS      ns3.whoami.domain.example.
@       NS      ns4.whoami.domain.example.

ns1     A       198.51.100.53
ns2     A       192.0.2.53
ns3     A       203.0.113.53
ns4     A       198.19.123.53

```

--------------------------------

### kxdpgun: Basic usage

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Runs kxdpgun with a queries file against an IPv6 target, using default settings (UDP, 5s duration, 1000 QPS).

```bash
# kxdpgun -i ~/queries.txt 2001:DB8::1

```

--------------------------------

### zone-key-rollover

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Triggers immediate key rollover for a specified zone and key type. Publishes a new key and starts rollover even if the key has lifetime remaining.

```APIDOC
## zone-key-rollover

### Description
Trigger immediate key rollover. Publish new key and start a key rollover, even when the key has a lifetime to go. Key type can be ksk (also for CSK) or zsk. This command is valid for zones with DNSSEC signing and automatic key management enabled.

### Parameters
#### Arguments
- **zone** (string) - Required - Zone name.
- **key_type** (string) - Required - Key type: `ksk` or `zsk`.

### Usage
`zone-key-rollover zone key_type`
```

--------------------------------

### Initialize Knot DNS configuration database

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Initializes a new binary configuration database for Knot DNS using the knotc conf-init command. This is useful for large configuration files.

```bash
$ knotc conf-init

```

--------------------------------

### Server section configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shows the server section with all its options and their types.

```yaml
server:
    identity: [STR]
    version: [STR]
    nsid: [STR|HEXSTR]
    rundir: STR
    user: STR[:STR]
    pidfile: STR
    udp-workers: INT
    tcp-workers: INT
    background-workers: INT
    async-start: BOOL
    tcp-idle-timeout: TIME
    tcp-io-timeout: INT
    tcp-remote-io-timeout: INT
    tcp-max-clients: INT
    tcp-reuseport: BOOL
    tcp-fastopen: BOOL
    remote-pool-limit: INT
    remote-pool-timeout: TIME
    remote-retry-delay: TIME
    socket-affinity: BOOL
    udp-max-payload: SIZE
    udp-max-payload-ipv4: SIZE
    udp-max-payload-ipv6: SIZE
    edns-client-subnet: BOOL
    answer-rotation: BOOL
    automatic-acl: BOOL
    dbus-event: none | running | zone-updated | ksk-submission | dnssec-invalid ...
    listen: ADDR[@INT] ...

```

--------------------------------

### whoami6.domain.example zone file with IPv6 nameservers

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Zone file for whoami6.domain.example. It defines four nameservers with only IPv6 addresses, as required for AAAA queries. The SOA TTL is 1 and the minimum TTL is 1.

```dns
$TTL 1

@       SOA     (
                        whoami6.domain.example.         ; MNAME
                        hostmaster.domain.example.      ; RNAME
                        2016051300                      ; SERIAL
                        86400                           ; REFRESH
                        86400                           ; RETRY
                        86400                           ; EXPIRE
                        1                               ; MINIMUM
                )

$TTL 86400

@       NS      ns1.whoami6.domain.example.
@       NS      ns2.whoami6.domain.example.
@       NS      ns3.whoami6.domain.example.
@       NS      ns4.whoami6.domain.example.

ns1     AAAA    2001:db8:100::53
ns2     AAAA    2001:db8:200::53
ns3     AAAA    2001:db8:300::53
ns4     AAAA    2001:db8:400::53

```

--------------------------------

### kdig: Query A records and reverse lookup over TCP

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Gets A records for example.com from 192.0.2.1 and performs a reverse lookup for address 2001:DB8::1 from 192.0.2.2, both using TCP protocol.

```bash
$ kdig +tcp example.com -t A @192.0.2.1 -x 2001:DB8::1 @192.0.2.2

```

--------------------------------

### Import BIND keys into KASP database

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Commands to import existing BIND zone keys into the Knot DNS KASP database and list them to verify correct import.

```bash
$ keymgr example.com. import-bind path/to/Kexample.com.+013+11111
$ keymgr example.com. import-bind path/to/Kexample.com.+013+22222
$ ...
$ keymgr example.com. list

```

--------------------------------

### zone-begin

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Begins a zone transaction.

```APIDOC
## zone-begin

### Description
Begin a zone transaction.

### Parameters
#### Arguments
- **zone** (string) - Required - Zone name(s).

### Usage
`zone-begin zone...`
```

--------------------------------

### Enable mod-onlinesign with explicit policy

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Zone configuration using an explicit signing policy with custom algorithm, key sizes, and RRSIG lifetime.

```yaml
policy:
  - id: rsa
    algorithm: RSASHA256
    ksk-size: 2048
    rrsig-lifetime: 25h
    rrsig-refresh: 20h

mod-onlinesign:
  - id: explicit
    policy: rsa

zone:
  - domain: example.com
    module: mod-onlinesign/explicit

```

--------------------------------

### Stack onlinesign with synthrecord

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Zone configuration combining the onlinesign module with the synthrecord module for reverse record synthesis.

```yaml
mod-synthrecord:
  - id: lan-forward
    type: forward
    prefix: ip-
    ttl: 1200
    network: 192.168.100.0/24

zone:
  - domain: corp.example.net
    module: [mod-synthrecord/lan-forward, mod-onlinesign]

```

--------------------------------

### Enable mod-whoami in Knot DNS configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Adds two zone entries to the Knot DNS configuration file to enable mod-whoami for whoami.domain.example and whoami6.domain.example. Each zone specifies a file path and the module name.

```yaml
zone:
  - domain: whoami.domain.example
    file: "/path/to/whoami.domain.example"
    module: mod-whoami

zone:
  - domain: whoami6.domain.example
    file: "/path/to/whoami6.domain.example"
    module: mod-whoami

```

--------------------------------

### Compile Knot DNS with make

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Run this command to compile Knot DNS after configuration. Compilation with optimizations may take a long time; the --disable-fastparser option can help.

```bash
$ make

```

--------------------------------

### sign-ksr

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Read a KeySigningRequest from a text file, sign it using the local keyset, and print a SignedKeyResponse to stdout.

```APIDOC
## sign-ksr

### Description
Read KeySigningRequest from a text file, sign it using local keyset and print SignedKeyResponse to stdout.

### Syntax
`sign-ksr _ksr_file_`

### Parameters
- `_ksr_file_` (file path) - Required - Path to the KeySigningRequest text file.

### Example
```
$ keymgr example.com. sign-ksr ksr.txt
```
```

--------------------------------

### Import a DNSSEC key from BIND

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Imports a DNSSEC key from a BIND key file using the import-bind command.

```bash
$ keymgr example.com. import-bind ~/bind/Kharbinge4d5.+007+63089.key

```

--------------------------------

### Recommended query module order

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Recommended order for specifying query modules in zone/template configuration. Modules are processed in the order they are listed.

```text
mod-synthrecord, mod-onlinesign, mod-cookies, mod-rrl, mod-dnstap, mod-stats

```

--------------------------------

### Restrict dynamic updates by owner name with update-owner and update-owner-match

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

ACL rule that restricts updates based on the owner name of updated records. Uses 'update-owner' to select the source of reference names and 'update-owner-match' to specify the required relation. The example requires the record owner to exactly match one of the listed names.

```yaml
acl:
  - id: owner_rule1
    action: update
    update-owner: name             # Updated record owners are restricted by the next conditions
    update-owner-match: equal      # The record owner must exactly match one name from the next list
    update-owner-name: [foo, bar.] # Reference domain names

```

--------------------------------

### Module section configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shows the module section structure with id and file items for loading dynamic modules.

```yaml
module:
  - id: STR
    file: STR

```

--------------------------------

### Multi-valued item as YAML sequence

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shows how to specify a multi-valued item as a YAML sequence, e.g., address: [10.0.0.1, 10.0.0.2].

```yaml
address: [10.0.0.1, 10.0.0.2]

```

--------------------------------

### Verify SoftHSM supported algorithms with pkcs11-tool

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Command to list algorithms supported by SoftHSM 2.0, which depends on OpenSSL support. Use the module path /usr/lib64/pkcs11/libsofthsm2.so.

```bash
$ pkcs11-tool --modul /usr/lib64/pkcs11/libsofthsm2.so -M
```

--------------------------------

### Configure key timing with keymgr set

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Sets key timing parameters for key ID 4208: active in +2 minutes, retire in +4 minutes, remove in +5 minutes.

```bash
$ keymgr example.com. set 4208 active=+2mi retire=+4mi remove=+5mi

```

--------------------------------

### kxdpgun: Using TCP

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Runs kxdpgun over TCP for 20 seconds at 100,000 QPS on port 8853, targeting an IPv4 address.

```bash
# kxdpgun -t 20 -Q 100000 -i ~/queries.txt -T -p 8853 192.0.2.1

```

--------------------------------

### Module reference configuration

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Configuration reference for the onlinesign module, showing available options: id, policy, and nsec-bitmap.

```yaml
mod-onlinesign:
  - id: STR
    policy: policy_id
    nsec-bitmap: STR ...

```

--------------------------------

### Include configuration file with knotc conf-set 'include'

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Use `knotc conf-set 'include'` to include an external configuration file. A non-absolute file location is relative to the server binary path, not the control binary path.

```bash
$ knotc conf-set 'include' '/tmp/new_zones.conf'

```

--------------------------------

### Migrate KASP DB with pykeymgr

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Run pykeymgr to migrate DNSSEC key metadata from JSON files to the binary LMDB format. The path is usually the 'keys' subdirectory in the zone storage.

```bash
$ pykeymgr -i path/to/keydir

```

--------------------------------

### Include directive

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shows the syntax for including another configuration file or files matching a pattern at the top level.

```yaml
include: STR

```

--------------------------------

### Policy configuration for manual key management

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Sets the 'manual: on' flag in a signing policy to enable manual key management. The zone uses this policy for DNSSEC signing.

```yaml
policy:
  - id: manual
    manual: on

zone:
  - domain: myzone.test
    dnssec-signing: on
    dnssec-policy: manual

```

--------------------------------

### Module reference: all mod-stats options

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shows the full set of configuration options for the 'mod-stats' module, each with a boolean value. Defaults are documented in the accompanying text.

```yaml
mod-stats:
  - id: STR
    request-protocol: BOOL
    server-operation: BOOL
    request-bytes: BOOL
    response-bytes: BOOL
    edns-presence: BOOL
    flag-presence: BOOL
    response-code: BOOL
    request-edns-option: BOOL
    response-edns-option: BOOL
    reply-nodata: BOOL
    query-type: BOOL
    query-size: BOOL
    reply-size: BOOL

```

--------------------------------

### dnsproxy module reference

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Lists all configuration options for mod-dnsproxy: id, remote (required), timeout (default 500), address, fallback (default on), tcp-fastopen (default off), catch-nxdomain (default off).

```yaml
mod-dnsproxy:
  - id: STR
    remote: remote_id
    timeout: INT
    address: ADDR[/INT] | ADDR-ADDR ...
    fallback: BOOL
    tcp-fastopen: BOOL
    catch-nxdomain: BOOL

```

--------------------------------

### Import configuration into Knot DNS database

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Preloads a configuration database from a textual configuration file using the knotc conf-import command. Note that this accesses the database directly without server interaction, so the server should not be running.

```bash
$ knotc conf-import input.conf

```

--------------------------------

### import-skr

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Read a SignedKeyResponse from a text file and import the signatures for later use in the zone. If some signatures have already been imported, they will be deleted for the period from the beginning of the SKR to infinity.

```APIDOC
## import-skr

### Description
Read SignedKeyResponse from a text file and import the signatures for later use in zone. If some signatures have already been imported, they will be deleted for the period from beginning of the SKR to infinity.

### Syntax
`import-skr _skr_file_`

### Parameters
- `_skr_file_` (file path) - Required - Path to the SignedKeyResponse text file.

### Example
```
$ keymgr example.com. import-skr skr.txt
```
```

--------------------------------

### Module reference configuration template

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Template showing all available parameters for the synthrecord module: id, type, prefix, origin, ttl, network, and reverse-short.

```yaml
mod-synthrecord:
  - id: STR
    type: forward | reverse
    prefix: STR
    origin: DNAME
    ttl: INT
    network: ADDR[/INT] | ADDR-ADDR ...
    reverse-short: BOOL

```

--------------------------------

### Minimal zone configuration with default DNSSEC signing

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Configures a zone with automatic DNSSEC signing using the default signing policy. The 'dnssec-signing: on' option enables signing.

```yaml
zone:
  - domain: myzone.test
    dnssec-signing: on

```

--------------------------------

### Enable mod-noudp for all zones

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Configures the mod-noudp module globally for all zones and every UDP reply.

```yaml
template:
  - id: default
    global-module: mod-noudp

```

--------------------------------

### Generate a new key for manual rollover

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Generates a new key that will become active in one day, allowing a manual rollover. The key is not activated immediately.

```bash
$ keymgr myzone.test. generate algorithm=ECDSAP256SHA256 ksk=yes zsk=yes active=+1d

```

--------------------------------

### Configure reverse synthrecord module

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Configuration for automatic reverse records. The module synthesizes PTR records for IPv6 addresses in the specified network when the query is not satisfied from the zone. The zone file must exist.

```yaml
mod-synthrecord:
  - id: test2
    type: reverse
    prefix: dynamic-
    origin: test
    ttl: 400
    network: 2620:0:b61::/52

zone:
  - domain: 1.6.b.0.0.0.0.0.0.2.6.2.ip6.arpa.
    file: 1.6.b.0.0.0.0.0.0.2.6.2.ip6.arpa.zone # Must exist
    module: mod-synthrecord/test2

```

--------------------------------

### Import SKR with keymgr import-skr

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Imports records and signatures from the SKR file into the KASP DB on the ZSK side. Importing a new SKR over a previous one deletes the old offline records.

```bash
$ keymgr -c /path/to/ZSK/side.conf example.com. import-skr /path/to/skr/file

```

--------------------------------

### Generate initial signing keys with keymgr

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Generates a single-type signing key (both KSK and ZSK) for the zone using the ECDSAP256SHA256 algorithm. After reloading the server, the zone will be signed.

```bash
$ keymgr myzone.test. generate algorithm=ECDSAP256SHA256 ksk=yes zsk=yes

```

--------------------------------

### Per-zone probe with 8 channels and max-rate limit

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Configuration for a per-zone 'probe' module with 8 channels and a maximum rate of 1,000,000 logs per second. The module is referenced in the zone configuration.

```yaml
mod-probe:
  - id: custom
    prefix: /tmp/knot-probe
    channels: 8
    max-rate: 1000000

zone:
  - domain: example.com.
    module: mod-probe/custom

```

--------------------------------

### Generate core dump of running process with gcore

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Command to generate a core dump of a running knotd process using gcore, specifying an output file and the process ID obtained via pidof.

```bash
$ gcore -o <output-file> $(pidof knotd)

```

--------------------------------

### Trigger online backup of all zones

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Run this command to manually trigger an online backup of all zones while the server is running. The backup directory must be empty or non-existing and writable by the knotd user. Check the logs for the outcome of each zone's backup attempt.

```bash
$ knotc zone-backup +backupdir /path/of/backup

```

--------------------------------

### probe module reference

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Reference configuration for the 'probe' module, listing its parameters: id, path, channels, and max-rate.

```yaml
mod-probe:
  - id: STR
    path: STR
    channels: INT
    max-rate: INT

```

--------------------------------

### Share a KSK from another zone

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Shares a KSK (identified by its key ID) from another zone with example.com.

```bash
$ keymgr example.com. share e687cf927029e9db7184d2ece6d663f5d1e5b0e9 another-zone.com.

```

--------------------------------

### ACL configuration with TSIG key

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Defines a TSIG key and ACL rules that use it. The zone 'acl2.example.com' denies all actions from a subnet and allows transfer/notify based on the key. All conditions in a rule must be satisfied for a match.

```yaml
key:
  - id: key1                           # The real TSIG key name
    algorithm: hmac-sha256
    secret: 4Tc0K1QkcMCs7cOW2LuSWnxQY0qysdvsZlSb4yTN9pA=

acl:
  - id: deny_all
    address: 192.168.3.0/24
    deny: on                           # No action specified and deny on implies denial of all actions

  - id: key_rule
    key: key1                          # Access based just on TSIG key
    action: [transfer, notify]

zone:
  - domain: acl2.example.com
    acl: [deny_all, key_rule]          # Allow with the TSIG except for the subnet

```

--------------------------------

### Read configuration with knotc conf-read

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Use `knotc conf-read` to read the whole configuration, a section, all identifiers of a section, or a specific item. The item name uses `section[identifier].name` format.

```bash
$ knotc conf-read
$ knotc conf-read 'remote'
$ knotc conf-read 'zone.domain'
$ knotc conf-read 'zone[example.com].master'

```

--------------------------------

### Freeze zone before flushing with rndc

Source: https://www.knot-dns.cz/docs/3.1/singlehtml

Command to freeze a zone in BIND before flushing it, necessary when dynamic updates are enabled.

```bash
$ rndc freeze example.com

```