TSIG Keys

TSIG keys authenticate dynamic updates. Keys are standalone resources; per-zone policies decide what a key is allowed to change.

# List all TSIG keys (secrets are not shown)
$ bindizr tsig-key list

# Show one key including its secret
$ bindizr tsig-key get update-key

# Delete a key (refused while zone TSIG policies still reference it)
$ bindizr tsig-key delete update-key

# Inspect or revoke a zone's policies
$ bindizr zone tsig-policy list example.com
$ bindizr zone tsig-policy remove example.com <POLICY_ID>

TSIG keys and policies are also manageable over the HTTP API (/tsig-keys, /zones/{name}/tsig-policies) — see the API Reference.