---
name: "cleankrf"
section: "1p"
platform: "linux"
package: "dnssec-tools"
version: "2.2.3-16"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/cleankrf"
---

# cleankrf(1p)

Clean a DNSSEC-Tools keyrec files of old data

## NAME

cleankrf - Clean a DNSSEC-Tools keyrec files of old data

## SYNOPSIS

```
  cleankrf [options] <keyrec-files>
```

## DESCRIPTION

**cleankrf** cleans old data out of a set of DNSSEC-Tools *keyrec* files. The old data are obsolete signing sets, orphaned keys, and obsolete keys.

Obsolete signing sets are set *keyrec*s unreferenced by a zone *keyrec*. Revoked signing sets are considered obsolete by **cleankrf**.

Orphaned keys are KSK and ZSK key *keyrec*s unreferenced by a set *keyrec*.

Obsolete keys are key *keyrec*s with a *keyrec\_type* of **kskobs** or **zskobs**.

**cleankrf**'s exit code is the count of orphaned and obsolete *keyrec*s found.

## OPTIONS

- **-count**

  Display a final count of old *keyrec*s found in the *keyrec* files.  This option allows the count to be displayed even if the **-quiet** option is given.

- **-list**

  The key *keyrec*s are checked for old *keyrec*s, but they are not removed from the *keyrec* file.  The names of the old *keyrec*s are displayed.

- **-rm**

  Delete the key files, both **.key** and **.private**, from orphaned and expired *keyrec*s.

- **-quiet**

  Display no output.

- **-verbose**

  Display output about referenced keys and unreferenced keys.

- **-Version**

  Displays the version information for **cleankrf** and the DNSSEC-Tools package.

- **-help**

  Display a usage message.

## COPYRIGHT

Copyright 2004-2014 SPARTA, Inc.  All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details.

## AUTHOR

Wayne Morrison, tewok@tislabs.com

## SEE ALSO

**fixkrf(8)**, **lskrf(8)**, **zonesigner(8)**

**Net::DNS::SEC::Tools::keyrec.pm(3)**

**file-keyrec.pm(5)**