Man page - named-checkconf(1)

Packages contains this manual

Package:  bind9-utils
apt-get install bind9-utils

Manuals in package:
• dnssec-dsfromkey(1)
• named-makejournal(1)
• dnssec-settime(1)
• named-checkconf(1)
• dnssec-revoke(1)
• named-checkzone(1)
• dnssec-ksr(1)
• dnssec-cds(1)
• dnssec-keyfromlabel(1)
• dnssec-signzone(1)
• dnssec-verify(1)
• rndc-confgen(8)
• dnssec-keygen(1)
• rndc(8)
• named-compilezone(1)
Documentations in package:
• bind9-utils

Manual

NAMED-CHECKCONF

NAME
SYNOPSIS
DESCRIPTION
OPTIONS
RETURN VALUES
SEE ALSO
Author
Copyright

---

NAME

named-checkconf - named configuration file syntax checking tool

SYNOPSIS

named-checkconf [ -achjklnvz ] [ -pe [ -x ]] [ -b ] [ -t directory] {filename}

DESCRIPTION

named-checkconf checks the syntax, but not the semantics, of a named <# std-iscman-named> configuration file. The file, along with all files included by it, is parsed and checked for syntax errors. If no file is specified, /etc/bind/named.conf is read by default.

Note: files that named <#std-iscman-named> reads in separate parser contexts, such as rndc.conf or rndc.key , are not automatically read by named-checkconf . Configuration errors in these files may cause named <#std-iscman-named> to fail to run, even if named-checkconf was successful. However, named-checkconf can be run on these files explicitly.

OPTIONS

	-a		Don't check the dnssec-policy 's DNSSEC key algorithms against those supported by the crypto provider. This is useful when checking a named.conf intended to be run on another machine with possibly a different set of supported DNSSEC key algorithms.
	-b		This option prints the built-in server confguration for named <# std-iscman-named>. See -e for more details.

Note that default settings may change between releases, so this information is only reliable if named-checkconf and named are from the same release.

When -b is in use, the other switches are ignored.

-e

This option prints the effective server configuration that would result from named.conf <#std-iscman-named.conf> and its included files, if no errors were detected, in canonical form.

The effective configuration is the result of loading a configuration file and applying it on top of the default settings for named . All configurable settings are included.

Note that default settings may change between releases, so the effective configuration generated by named-checkconf is only expected to be correct for the same version of named , built with the same compile-time options.

See also the -b , -x and -p options.

	-h		This option prints the usage summary and exits.
	-j		When loading a zonefile, this option instructs named <# std-iscman-named> to read the journal if it exists.
	-k		Check the dnssec-policy 's DNSSEC keys against the key files in the key-directory . This is useful when checking a named.conf to ensure a DNSSEC policy matches the existing keys.
	-l		This option lists all the configured zones. Each line of output contains the zone name, class (e.g. IN), view, and type (e.g. primary or secondary).
	-c		This option specifies that only the "core" configuration should be checked. This suppresses the loading of plugin modules, and causes all parameters to plugin statements to be ignored.
	-i		This option ignores warnings on deprecated options.
	-n		Do not print errors when encountering options that are disabled in this build. This allows checking of configuration files for other builds, in which those options are enabled.
	-p		This option prints the contents of named.conf <#std-iscman-named .conf> and all included files in canonical form, if no errors were detected. See also the -x and -e options.

-t directory

This option instructs named <#std-iscman-named> to chroot to directory , so that include directives in the configuration file are processed as if run by a similarly chrooted named <# std-iscman-named>.

	-v		This option prints the version of the named-checkconf program and exits.
	-x		When printing the configuration files in canonical form, this option obscures shared secrets by replacing them with strings of question marks ( ? ). This allows the contents of named.conf <# std-iscman-named.conf> and related files to be shared - for example, when submitting bug reports - without compromising private data. This option cannot be used without -p .
	-z		This option performs a test load of all zones of type primary found in named.conf <#std-iscman-named.conf>.

filename

This indicates the name of the configuration file to be checked. If not specified, it defaults to /etc/bind/named.conf .

RETURN VALUES

named-checkconf returns an exit status of 1 if errors were detected and 0 otherwise.

SEE ALSO

named(8) <#std-iscman-named>, named-checkzone(8) <# std-iscman-named-checkzone>, BIND 9 Administrator Reference Manual.

Author

Internet Systems Consortium

Copyright

2026, Internet Systems Consortium

---