NAMED-CHECKCONF(1) BIND 9 NAMED-CHECKCONF(1)

# [NAME](#NAME)

named-checkconf - named configuration file syntax checking tool

# [SYNOPSIS](#SYNOPSIS)

**named-checkconf** \[**-achjklvz**] \[**-p** \[**-x** ]] \[**-t** directory] {filename}

# [DESCRIPTION](#DESCRIPTION)

**named-checkconf** checks the syntax, but not the semantics, of a **named** &lt;#std-iscman-named&gt; configuration file. The file, along with all files included by it, is parsed and checked for syntax errors. If no file is specified, **/etc/bind/named.conf** is read by default.

Note: files that **named** &lt;#std-iscman-named&gt; reads in separate parser contexts, such as **rndc.conf** or **rndc.key**, are not automatically read by **named-checkconf**. Configuration errors in these files may cause **named** &lt;#std-iscman-named&gt; to fail to run, even if **named-checkconf** was successful. However, **named-checkconf** can be run on these files explicitly.

# [OPTIONS](#OPTIONS)

[**-a**](#a)

Don't check the *dnssec-policy*'s DNSSEC key algorithms against those supported by the crypto provider. This is useful when checking a *named.conf* intended to be run on another machine with possibly a different set of supported DNSSEC key algorithms.

[**-h**](#h)

This option prints the usage summary and exits.

[**-j**](#j)

When loading a zonefile, this option instructs **named** &lt;#std-iscman-named&gt; to read the journal if it exists.

[**-k**](#k)

Check the *dnssec-policy*'s DNSSEC keys against the key files in the *key-directory*. This is useful when checking a *named.conf* to ensure a DNSSEC policy matches the existing keys.

[**-l**](#l)

This option lists all the configured zones. Each line of output contains the zone name, class (e.g. IN), view, and type (e.g. primary or secondary).

[**-c**](#c)

This option specifies that only the "core" configuration should be checked. This suppresses the loading of plugin modules, and causes all parameters to **plugin** statements to be ignored.

[**-i**](#i)

This option ignores warnings on deprecated options.

[**-p**](#p)

This option prints out the **named.conf** &lt;#std-iscman-named.conf&gt; and included files in canonical form if no errors were detected. See also the **-x** option.

[**-t directory**](#t)

This option instructs **named** &lt;#std-iscman-named&gt; to chroot to **directory**, so that **include** directives in the configuration file are processed as if run by a similarly chrooted **named** &lt;#std-iscman-named&gt;.

[**-v**](#v)

This option prints the version of the **named-checkconf** program and exits.

[**-x**](#x)

When printing the configuration files in canonical form, this option obscures shared secrets by replacing them with strings of question marks (**?**). This allows the contents of **named.conf** &lt;#std-iscman-named.conf&gt; and related files to be shared - for example, when submitting bug reports - without compromising private data. This option cannot be used without **-p**.

[**-z**](#z)

This option performs a test load of all zones of type **primary** found in **named.conf** &lt;#std-iscman-named.conf&gt;.

[**filename**](#filename)

This indicates the name of the configuration file to be checked. If not specified, it defaults to **/etc/bind/named.conf**.

# [RETURN VALUES](#RETURN_VALUES)

**named-checkconf** returns an exit status of 1 if errors were detected and 0 otherwise.

# [SEE ALSO](#SEE_ALSO)

[**named(8)**](/man/os/bind/named.8) &lt;#std-iscman-named&gt;, [**named-checkzone(8)**](/man/os/bind/named-checkzone.8) &lt;#std-iscman-named-checkzone&gt;, BIND 9 Administrator Reference Manual.

# [Author](#Author)

Internet Systems Consortium

# [Copyright](#Copyright)

2026, Internet Systems Consortium

2026-11-05 9.20.30

---

Document: named-checkconf(1) from bind 9.20.30-r1 (Chainguard OS)
Source: https://gitlab.isc.org/isc-projects/bind9.git