Sign and verify zone files with RSA Keys

1. Use dnssec-signzone command to perform zone signing.

# dnssec-signzone -E pkcs11 -S -o example.net /var/named/example.net 

Zone signing for RSA key

This generates the example.net.signed file.

2. Verify the signed zone file.

# dnssec-verify -E pkcs11 -z -o example.net /var/named/example.net.signed Kexample.net.+008+06500.key Kexample.net.+008+44509.key

Zone verification for RSA Key

Where Kexample.net.+008+06500.key is key file generated for ksk key and Kexample.net.+008+44509.key is key file generated for zsk key.