Usage: DnsCmd /ZoneAddSKD /Alg /Length /KSP /Flags /StoreKeysInAD /DoNotStoreKeysInAD /InitialRolloverOffset /DNSKEYSignatureValidityPeriod ...

Usage: DnsCmd  /ZoneAddSKD  /Alg  [/Length ] 
  [/KSP ] [/Flags ] [/StoreKeysInAD]
  [/DoNotStoreKeysInAD] [/InitialRolloverOffset ]
  [/DNSKEYSignatureValidityPeriod ] [/DSSignatureValidityPeriod ]
  [/StandardSignatureValidityPeriod ] [/RolloverPeriod ]
   -- "Microsoft Software Key Storage Provider" or
                     other KSP installed on this system
          -- the key algorithm mnemonic string. Currently only
                     "RSASHA1", "NSEC3RSASHA1", "RSASHA256", "RSASHA512",
                     "ECDSAP256SHA256" and "ECDSAP384SHA384" are supported.
       -- length of the key in bits. For RSA algorithms the value
                     can range from 1024 bits in 64 bit increments up to 4096
                     bits. Key size is ignored for other algorithms.
        -- bits to be set to 1 in DNSKEY flags field. If 
                     is "KSK",  the Secure Entry Point bit will be set to 1
                     to indicate that this key is a Key Signing Key. If no
                     /Flags is given, the key is considered to be a Zone
                     Signing Key.
  /StoreKeysInAD  -- if specified, keys will be stored on the zone object in
                     Active Directory and will replicate to other DNS servers
  /DoNotStoreKeysInAD -- if specified, keys will be stored in a self-signed
                     certificate in the local machine certificate store and
                     will not replicate to other DNS servers