Checker Bind Zone Files Syntax
Fast, accurate and free online checker bind zone files syntax tool running directly in your browser.
-
1Enter data
Enter content, paste text or load a file from disk. -
2Click the button
The tool will immediately process your data in the browser. -
3Get the result
Copy the finished text or save the file to your device.
return "Result ready in 0.1s";
}
Rate this tool:
Related tools
Other tools you may find usefulDNS zone file validator BIND - errors before the server
An error in the DNS zone file (zone file) can cause the entire domain to stop working. The tool parses the syntax of the BIND 9 zone file and detects: typographical errors, invalid records, CNAME conflicts, missing SOA/NS and TTL problems - before you upload the file to the DNS server.
BIND zone file structure
$ORIGIN example.com. (base domain). $TTL 3600 (default TTL). SOA (Start of Authority): primary NS, admin email, serial, refresh, retry, expire, minimum TTL. NS records: at least 2 authoritative servers. A/AAAA: Host IPv4/IPv6. MX: priority mail servers. TXT: SPF, DKIM, DMARC, verifications. CNAME: alias (cannot coexist with other records on the same node).
Common syntax errors
Missing dot at the end of full name: mail.example.com (error) vs mail.example.com. (correct). Wrong SOA format (field order). Serial not updated after changes (bind will not reload). MX pointing to CNAME (prohibited by RFC). CNAME on apex domains (@) – prohibited (use ALIAS/ANAME). Invalid IPv6 format (double ::).
Special records
SPF: "v=spf1 include:_spf.google.com ~all" as TXT. DKIM: long public key divided into segments (max 255 characters per string). DMARC: _dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]". CAA: CA authorization to issue an SSL certificate.
DNS Testing Tools
named-checkzone (BIND): named-checkzone example.com /etc/bind/db.example.com. named-checkconf: validation of named.conf. dig +short example.com @ns1.example.com: test after upload. Online: mxtoolbox.com, dnschecker.org. The online tool replaces named-checkzone without installing BIND.
FAQ
What is a serial number and why is it important?
Serial in SOA record: monotonically increasing number (e.g. YYYYMMDDNN: 2024060801). Secondary DNS servers check the serial - if the primary one is higher, they download the update (AXFR/IXFR). No serial increment: changes do not propagate to secondary servers!
How many TTL should I set for records?
TTL short (300s = 5min): when you plan a change - easy rollback. Disadvantage: more DNS queries. TTL long (86400s = 1 day): less traffic, faster responses (cache). Recommendations: A/AAAA = 3600s, MX = 3600s, TXT/SPF = 300-3600s, NS = 86400s. Before migration: change TTL to 300s 2 days before migration.
Why can't CNAME be on an apex (root) domain?
RFC 2181: CNAME cannot coexist with other record types. Apex domain (example.com.) must have SOA and NS records - so CNAME is impossible. Solution: ALIAS (PowerDNS), ANAME (Route 53) or HTTP redirect. Cloudflare CNAME Flattening solves this problem transparently.
How to check DNS propagation after a change?
dig example.com @8.8.8.8 (Google DNS). dig example.com @1.1.1.1 (Cloudflare). dnschecker.org: 20+ locations at once. Propagation time: min TTL of the previous record (may be several hours a day). "DNS propagation" is a myth - it's cache expiration, not active propagation.
How to configure DNSSEC?
DNSSEC digitally signs DNS records. named-keygen generates ZSK and KSK keys. Zone files: signed zone + RRSIG + DNSKEY + DS. BIND configuration: dnssec-enable yes; dnssec-validation yes. Alternative: Cloudflare One-Click DNSSEC (takes over signing).
Related tools: WHOIS lookup, robots.txt validator and DNS lookup.