NAMED-CHECKZONE(1)

💖 named-checkzone — the zone file vibe checker 💖

okay so bestie, welcome to named-checkzone(1) from the BIND 9 fam — this is the zone file validity checking or converting tool, and honestly it's giving backstage-pass energy for your zone files 🎀

---

✨ SYNOPSIS ✨

named-checkzone [-d] [-h] [-j] [-q] [-v] [-c class] [-C mode] [-f format]
                [-F format] [-J filename] [-i mode] [-k mode] [-m mode]
                [-M mode] [-n mode] [-l ttl] [-L serial] [-o filename]
                [-r mode] [-s style] [-S mode] [-t directory] [-T mode]
                [-w directory] [-D] [-W mode] {zonename} {filename}

like, yes, that's a lot of flags. she's high-maintenance and she's worth it 💅

---

🌸 DESCRIPTION 🌸

named-checkzone checks the syntax and integrity of a zone file. fr fr — it runs the exact same checks that named does when it loads a zone. which is why this tool is iconic: you can validate your zone files before you configure them into a name server and everything goes sideways at 3am 😭

---

🦋 OPTIONS 🦋

• -d — turns on debugging. the verbose bestie mode ✨
• -h — prints the usage summary and exits. a little "here's how to use me" moment 🫶
• -q — quiet mode: it only sets an exit code to show whether it succeeded or failed. no chatter, just vibes and a number 🤫
• -v — prints the version of the named-checkzone program and exits 👑
• -j — when loading a zone file, this tells named to read the journal if it exists. the journal file name is assumed to be the zone file name with the string .jnl appended. periodt 💜
• -J filename — when loading the zone file, this tells named to read the journal from the given file, if it exists. this implies -j 🎀
• -c class — specifies the class of the zone. if you don't specify it, IN is assumed 🌈
• -C mode — controls check mode on zone files when loading. possible modes are check-svcb:fail and check-svcb:ignore.
  • check-svcb:fail turns on additional checks on _dns SVCB records.
  • check-svcb:ignore disables these checks.
  • the default is check-svcb:fail.
• -i mode — performs post-load zone integrity checks. possible modes are full (the default), full-sibling, local, local-sibling, and none. ngl this one's a whole saga, so buckle up:
  • mode full checks that MX records refer to A or AAAA records (both in-zone and out-of-zone hostnames). mode local only checks MX records which refer to in-zone hostnames.
  • mode full checks that SRV records refer to A or AAAA records (both in-zone and out-of-zone hostnames). mode local only checks SRV records which refer to in-zone hostnames.
  • mode full checks that delegation NS records refer to A or AAAA records (both in-zone and out-of-zone hostnames). it also checks that glue address records in the zone match those advertised by the child. mode local only checks NS records which refer to in-zone hostnames or verifies that some required glue exists, i.e., when the name server is in a child zone.
  • modes full-sibling and local-sibling disable sibling glue checks, but are otherwise the same as full and local, respectively.
  • mode none disables the checks. 🧚
• -f format — specifies the format of the zone file. possible formats are text (the default) and raw 🔥
• -F format — specifies the format of the output file specified. for named-checkzone, this does not have any effect unless it dumps the zone contents 🍓
  • possible formats are text (the default), which is the standard textual representation of the zone, and raw and raw=N, which store the zone in a binary format for rapid loading by named.
  • raw=N specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of named; if N is 1, the file can only be read by release 9.9.0 or higher. the default is 1.
• -k mode — performs check-names checks with the specified failure mode. possible modes are fail, warn (the default), and ignore 💫
• -l ttl — sets a maximum permissible TTL for the input file. any record with a TTL higher than this value causes the zone to be rejected 😱 this is similar to using the max-zone-ttl option in named.conf.
• -L serial — when compiling a zone to raw format, this sets the "source serial" value in the header to the specified serial number. this is expected to be used primarily for testing purposes 🧪
• -m mode — specifies whether MX records should be checked to see if they are addresses. possible modes are fail, warn (the default), and ignore 📬
• -M mode — checks whether a MX record refers to a CNAME. possible modes are fail, warn (the default), and ignore 🙈
• -n mode — specifies whether NS records should be checked to see if they are addresses. possible modes are fail, warn (the default), and ignore 🌐
• -o filename — writes the zone output to filename. if filename is -, then the zone output is written to standard output 📝
• -r mode — checks for records that are treated as different by DNSSEC but are semantically equal in plain DNS. possible modes are fail, warn (the default), and ignore 🪄
• -s style — specifies the style of the dumped zone file. possible styles are full (the default) and relative.
  • the full format is most suitable for processing automatically by a separate script.
  • the relative format is more human-readable and is thus suitable for editing by hand.
  • this does not have any effect unless it dumps the zone contents. it also does not have any meaning if the output format is not text. ✍️
• -S mode — checks whether an SRV record refers to a CNAME. possible modes are fail, warn (the default), and ignore 🎯
• -t directory — tells named to chroot to directory, so that include directives in the configuration file are processed as if run by a similarly chrooted named. lowkey a jail cell for your files 🔐
• -T mode — checks whether Sender Policy Framework (SPF) records exist and issues a warning if an SPF-formatted TXT record is not also present. possible modes are warn (the default) and ignore 📨
• -w directory — instructs named to chdir to directory, so that relative filenames in master file $INCLUDE directives work. this is similar to the directory clause in named.conf 📂
• -D — dumps the zone file in canonical format 💅
• -W mode — specifies whether to check for non-terminal wildcards. non-terminal wildcards are almost always the result of a failure to understand the wildcard matching algorithm (RFC 4592). possible modes are warn (the default) and ignore. no cap, read RFC 4592 🌀
• zonename — the domain name of the zone being checked 👑
• filename — the name of the zone file 🗂️

---

🫶 RETURN VALUES 🫶

named-checkzone returns an exit status of 1 if errors were detected and 0 otherwise. so basically 0 = slay, 1 = 😭

---

🌟 SEE ALSO 🌟

• named(8)
• named-checkconf(8)
• named-compilezone(8)
• RFC 1035
• BIND 9 Administrator Reference Manual

---

👑 Author

Internet Systems Consortium

🎀 Copyright

2026, Internet Systems Consortium

---

and that's the tea, bestie 🦋 this page is from BIND 9.20.30, dated 2026-10-12 — go forth and validate your zones, mwah 💋