NAMED-CHECKCONF(1)

💅 NAMED-CHECKCONF(1) — the vibe check for your named config ✨

okay bestie, so this is named-checkconf, straight out of BIND 9 (section 1 of the manual, if you're keeping track 🎀). Think of it as the friend who reads your text messages before you hit send, except the message is a named configuration file and the send button is production. 💀

---

✨ NAME ✨

named-checkconf — the named configuration file syntax checking tool 🦋

---

🌸 SYNOPSIS 🌸

named-checkconf [-achjklvz] [-p [-x ]] [-t directory] {filename}

---

💖 DESCRIPTION 💖

named-checkconf checks the syntax, but not the semantics, of a named configuration file. It parses the file — plus every single file included by it — and hunts for syntax errors. If you don't hand it a file, it reads /etc/bind/named.conf by default. periodt. 🫶

⚠️ note, bestie: files that named reads in separate parser contexts — like rndc.conf or rndc.key — are not automatically read by named-checkconf. So config errors hiding in those files can still make named refuse to run, even if named-checkconf was like "ur fine ✨". The good news? You can run named-checkconf on those files explicitly yourself. 💅

---

🌈 OPTIONS 🌈

• -a — doesn't check the dnssec-policy's DNSSEC key algorithms against the ones your crypto provider actually supports. lowkey iconic when you're checking a named.conf that's meant to run on another machine with a possibly different set of supported DNSSEC key algorithms. 🧚
• -h — prints the usage summary and exits. the classic "who am i" flag 🎀
• -j — when loading a zonefile, this tells named to read the journal if it exists. 🔥
• -k — checks the dnssec-policy's DNSSEC keys against the key files in the key-directory. super useful when you're checking a named.conf to make sure a DNSSEC policy matches the keys you already have. 🔑
• -l — lists all the configured zones. every line of output has the zone name, class (e.g. IN), view, and type (e.g. primary or secondary). a whole lil inventory, slay 📋
• -c — says "only the core configuration, please". this suppresses loading of plugin modules and makes all parameters to plugin statements get ignored. 🙈
• -i — ignores warnings on deprecated options. living in denial, but make it a flag 💀
• -p — prints out named.conf and the included files in canonical form, but only if zero errors were detected. see also -x 👀
• -t directory — tells named to chroot to directory, so that include directives in the config file get processed as if they were run by a named that's chrooted the same exact way. 🏠
• -v — prints the version of the named-checkconf program and exits. 🏷️
• -x — when printing config files in canonical form, this obscures shared secrets by swapping them for strings of question marks (?). this is the one that lets you share the contents of named.conf and related files — like when you're submitting bug reports 🐛 — without leaking private data. this option cannot be used without -p. 🚫
• -z — performs a test load of all zones of type primary found in named.conf. a full dress rehearsal 💃
• filename — the name of the configuration file to be checked. if you don't specify it, it defaults to /etc/bind/named.conf. 🗂️

---

👑 RETURN VALUES 👑

named-checkconf returns an exit status of 1 if errors were detected, and 0 otherwise. clean. ✨

---

🦋 SEE ALSO 🦋

• named(8)
• named-checkzone(8)
• BIND 9 Administrator Reference Manual

---

🍓 Author 🍓

Internet Systems Consortium

💜 Copyright 💜

2026, Internet Systems Consortium

---

okay that's the whole page, no cap 💅 and just so we're cute and complete: this gem is from BIND 9, version 9.20.30, dated 2026-10-12 — go forth and check those configs, bestie, ur gonna ate 🎀✨🦋