A small shell script to make DS records from DNSKEYS. Useful for quickly checking if a proposed DS record seems sane. Does no error checking, etc...

dnssec_make_ds.sh

#!/bin/bash
#
# This script will fetch the DNSKEY records for a domain, and generate a DS record
#=-=-=-=-=-=-=-=-=-=-=-

# Check for required number of arguments.
if [ $# -ne 1 ] ; then
  cat <<EOF

  This will fetch the DNSKEY records for a domain, and generate DS records for
  the same.

  Args:
      domain: A domain name - e.g: e164.arpa

  Usage:
    $0 <domain>

EOF
  exit
fi

DNSKEY=$(dig DNSKEY $1 | grep "DNSKEY" | grep -v ';')

echo -e "DNSKEYS for $1:\n$DNSKEY\n\n"

temp_file=$(mktemp)
echo "$DNSKEY" > $temp_file
ds=$(dnssec-dsfromkey -f $temp_file $1)
echo -e "DS for $1:\n$ds\n\n"
rm $temp_file