nsd-checkzone(8)

💅 nsd-checkzone — bestie's zone file vibe check

okay so this is nsd-checkzone, part of nsd (version 4.15.4) — the little syntax checker that makes sure your zone file isn't a whole mess before you hand it to the actual daemon. Your manual section 8 era 🎀

---

✨ SYNOPSIS ✨

nsd-checkzone [-h] zonename zonefile

---

🌸 DESCRIPTION 🌸

So here's the tea: nsd-checkzone reads a DNS zone file and checks it for errors. That's literally its whole job and it eats every time. 🍓

It prints errors to stderr. And if something's wrong? On failure it exits with nonzero exit status — so like, the exit code is giving "nope" 😭

The whole point: this is used to check files before feeding them to the nsd(8) daemon. Vibe check first, serve later, periodt. 👑

---

🦋 OPTIONS 🦋

• -h — Print usage help information and exit. That's it, that's the option. Very demure.
• zonename — The name of the zone to check, eg. "example.com".
• zonefile — The file to read, eg. "zones/example.com.zone.signed". Use "-" to read from stdin. yes bestie, stdin is allowed, slay 💖
• -p — Print the zone contents to stdout if the zone is ok. Important nuance tho: this prints the contents as it has been parsed, not literally a copy of the input — it's as printed by the formatting routines in NSD, much like the nsd-control command write does. So don't come for it expecting a mirror image, it's giving interpretation ✨
• -i <oldzonefile> — Create an IXFR from the differences between the old zone file and the new zone file. The argument to the -i option is the old zone file, and the other zonefile argument you passed is the new zonefile. Two files, one glow-up diff 💫

The difference is computed between the two zonefiles by keeping one version of the zone in memory, and another version in a temporary file. The temporary file is located at the zonefile directory. This is also where the result is written, to a file with the zonefile name, ending with '.ixfr'. This is also where NSD reads it when IXFRs are configured for the zone.

The other existing ixfr files are renamed to become older IXFR contents for the zone, if any such files exist. If the output file already exists with the correct contents, no new file is created. The contents of the header of the output file are checked for that, if it already exists. (efficient queen behavior 👑)

• -n <ixfr number> — The number of IXFR versions to store, at most. Default 5. This is the number of files that is created with ixfr contents for the zone. Older stored IXFR versions are deleted when the number is exceeded. Purge era 💀
• -s <ixfr size> — The number of bytes of storage to use for IXFRs. Default is 1048576. If an IXFR is bigger it is not created, and if the sum of IXFR storage exceeds it, older IXFRs versions are deleted. Budget queen — no unchecked growth in this house 🌈

⚠️ heads up bestie: -i writes into the zonefile directory and rotates your existing ixfr files. That's by design, but like… know that's what's happening before you run it, fr fr 🙈

---

🔥 SEE ALSO 🔥

• nsd(8)
• nsd-checkconf(8)

go read those too, they're the supporting cast and they ate 💅

---

👑 AUTHORS 👑

NSD was written by NLnet Labs and RIPE NCC joint team. Please see the CREDITS file in the distribution for further details. iconic collaborative energy honestly 🫶

---

mwah 💖 that's the whole page — brought to you by the legends at NLnet Labs, dated okt 21, 2026, living in nsd 4.15.4 land. now go check those zones bestie, iykyk ✨🎀