> "ddns-confgen -q"

(Also known as "tsig-keygen", since BIND 9.10.)