---
name: "ldns_dnssec_zone_create_rrsigs"
section: "3"
platform: "linux"
package: "ldns"
version: "1.9.2-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/ldns_dnssec_zone_create_rrsigs"
---

# ldns\_dnssec\_zone\_create\_rrsigs(3)

sign ldns\_dnssec\_zone

## NAME

ldns\_dnssec\_zone\_sign, ldns\_dnssec\_zone\_sign\_nsec3, ldns\_dnssec\_zone\_mark\_glue, ldns\_dnssec\_name\_node\_next\_nonglue, ldns\_dnssec\_zone\_create\_nsecs, ldns\_dnssec\_remove\_signatures, ldns\_dnssec\_zone\_create\_rrsigs - sign ldns\_dnssec\_zone

## SYNOPSIS

\#include \<stdint.h\>\
 \#include \<stdbool.h\>\

\#include \<ldns/ldns.h\>

ldns\_status ldns\_dnssec\_zone\_sign(ldns\_dnssec\_zone \*zone, ldns\_rr\_list \*new\_rrs, ldns\_key\_list \*key\_list, int (\*func)(ldns\_rr \*, void \*), void \*arg);

ldns\_status ldns\_dnssec\_zone\_sign\_nsec3(ldns\_dnssec\_zone \*zone, ldns\_rr\_list \*new\_rrs, ldns\_key\_list \*key\_list, int (\*func)(ldns\_rr \*, void \*), void \*arg, uint8\_t algorithm, uint8\_t flags, uint16\_t iterations, uint8\_t salt\_length, uint8\_t \*salt);

 ldns\_dnssec\_zone\_mark\_glue();

ldns\_rbnode\_t\* ldns\_dnssec\_name\_node\_next\_nonglue(ldns\_rbnode\_t \*node);

ldns\_status ldns\_dnssec\_zone\_create\_nsecs(ldns\_dnssec\_zone \*zone, ldns\_rr\_list \*new\_rrs);

ldns\_dnssec\_rrs\* ldns\_dnssec\_remove\_signatures(ldns\_dnssec\_rrs \*signatures, ldns\_key\_list \*key\_list, int (\*func)(ldns\_rr \*, void \*), void \*arg);

ldns\_status ldns\_dnssec\_zone\_create\_rrsigs(ldns\_dnssec\_zone \*zone, ldns\_rr\_list \*new\_rrs, ldns\_key\_list \*key\_list, int (\*func)(ldns\_rr \*, void\*), void \*arg);

## DESCRIPTION

*ldns\_dnssec\_zone\_sign*() signs the given zone with the given keys

.br **zone**: the zone to sign .br **key\_list**: the list of keys to sign the zone with .br **new\_rrs**: newly created resource records are added to this list, to free them later .br **func**: callback function that decides what to do with old signatures This function takes an ldns\_rr\* and an optional void \*arg argument, and returns one of four values: LDNS\_SIGNATURE\_LEAVE\_ADD\_NEW: leave the signature and add a new one for the corresponding key LDNS\_SIGNATURE\_REMOVE\_ADD\_NEW: remove the signature and replace is with a new one from the same key LDNS\_SIGNATURE\_LEAVE\_NO\_ADD: leave the signature and do not add a new one with the corresponding key LDNS\_SIGNATURE\_REMOVE\_NO\_ADD: remove the signature and do not replace

.br **arg**: optional argument for the callback function .br Returns LDNS\_STATUS\_OK on success, an error code otherwise

*ldns\_dnssec\_zone\_sign\_nsec3*() signs the given zone with the given new zone, with NSEC3

.br **zone**: the zone to sign .br **key\_list**: the list of keys to sign the zone with .br **new\_rrs**: newly created resource records are added to this list, to free them later .br **func**: callback function that decides what to do with old signatures .br **arg**: optional argument for the callback function .br **algorithm**: the NSEC3 hashing algorithm to use .br **flags**: NSEC3 flags .br **iterations**: the number of NSEC3 hash iterations to use .br **salt\_length**: the length (in octets) of the NSEC3 salt .br **salt**: the NSEC3 salt data .br Returns LDNS\_STATUS\_OK on success, an error code otherwise

*ldns\_dnssec\_zone\_mark\_glue*()

*ldns\_dnssec\_name\_node\_next\_nonglue*() Finds the first dnssec\_name node in the rbtree that is not occluded. It \*does\* return names that are partially occluded.

.br **node**: the first node to check .br Returns the first node that has not been marked as glue, or NULL if not found (TODO: make that LDNS\_RBTREE\_NULL?)

*ldns\_dnssec\_zone\_create\_nsecs*() Adds NSEC records to the given dnssec\_zone

.br **zone**: the zone to add the records to .br **new\_rrs**: ldns\_rr's created by this function are added to this rr list, so the caller can free them later .br Returns LDNS\_STATUS\_OK on success, an error code otherwise

*ldns\_dnssec\_remove\_signatures*() remove signatures if callback function tells to

.br **signatures**: list of signatures to check, and possibly remove, depending on the value of the callback .br **key\_list**: these are marked to be used or not, on the return value of the callback .br **func**: this function is called to specify what to do with each signature (and corresponding key) .br **arg**: Optional argument for the callback function .br Returns s pointer to the new signatures rrs (the original passed to this function may have been removed)

*ldns\_dnssec\_zone\_create\_rrsigs*() Adds signatures to the zone

.br **zone**: the zone to add RRSIG Resource Records to .br **new\_rrs**: the RRSIG RRs that are created are also added to this list, so the caller can free them later .br **key\_list**: list of keys to sign with. .br **func**: Callback function to decide what keys to use and what to do with old signatures .br **arg**: Optional argument for the callback function .br Returns LDNS\_STATUS\_OK on success, error otherwise

## AUTHOR

The ldns team at NLnet Labs.

## REPORTING BUGS

Please report bugs to dns-team@nlnetlabs.nl or on GitHub at https://github.com/NLnetLabs/ldns/issues

## COPYRIGHT

Copyright (c) 2004 - 2006 NLnet Labs.

Licensed under the BSD License. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

## SEE ALSO

*ldns\_dnssec\_zone*. And **perldoc Net::DNS**, **RFC1034**, **RFC1035**, **RFC4033**, **RFC4034**  and **RFC4035**.

## REMARKS

This manpage was automatically generated from the ldns source code.