NAMED-RRCHECKER(1) BIND 9 NAMED-RRCHECKER(1)

# [NAME](#NAME)

named-rrchecker - syntax checker for individual DNS resource records

# [SYNOPSIS](#SYNOPSIS)

**named-rrchecker** \[**-h**] \[**-o** origin] \[**-p**] \[**-u**] \[**-C**] \[**-T**] \[**-P**]

# [DESCRIPTION](#DESCRIPTION)

**named-rrchecker** reads a single DNS resource record (RR) from standard input and checks whether it is syntactically correct.

[**The input format is a minimal subset of the DNS zone file format. The entire input must be:**](#The)

CLASS TYPE RDATA

- Input must not start with an owner (domain) name
- The *CLASS* field is mandatory (typically **IN**).
- The *TTL* field **must not** be present.
- RDATA format is specific to each RRTYPE.
- Leading and trailing whitespace in each field is ignored.

Format details can be found in **RFC 1035 Section 5.1** <https://datatracker.ietf.org/doc/html/rfc1035.html#section-5.1> under **<rr>** specification. **RFC 3597** <https://datatracker.ietf.org/doc/html/rfc3597.html> format is also accepted in any of the input fields. See Examples.

# [OPTIONS](#OPTIONS)

[**-o origin**](#o)

This option specifies the origin to be used when interpreting names in the record: it defaults to root (*.*). The specified origin is always taken as an absolute name.

[**-p**](#p)

This option prints out the resulting record in canonical form. If there is no canonical form defined, the record is printed in **RFC 3597** <https://datatracker.ietf.org/doc/html/rfc3597.html> unknown record format.

[**-u**](#u)

This option prints out the resulting record in **RFC 3597** <https://datatracker.ietf.org/doc/html/rfc3597.html> unknown record format.

[**-C, -T, -P**](#C,)

These options do not read input. They print out known classes, standard types, and private type mnemonics. Each item is printed on a separate line. The resulting list of private types may be empty

[**-h**](#h)

This option prints out the help menu.

# [EXAMPLES](#EXAMPLES)

Pay close attention to the **echo** command line options *-e* and *-n*, as they affect whitespace in the input to **named-rrchecker**.

[**echo -n 'IN A 192.0.2.1' | named-rrchecker**](#echo)

- Valid input is in **RFC 1035** <https://datatracker.ietf.org/doc/html/rfc1035.html> format with no newline at the end of the input.
- Return code 0.

[**echo -e '\\n \\n IN\\tA 192.0.2.1 \\t \\n\\n ' | named-rrchecker -p**](#echo~2)

- Valid input with leading and trailing whitespace.
- Output: **IN A 192.0.2.1**
- Leading and trailing whitespace is not part of the output.

## [Relative names and origin](#Relative_names_and_origin)

[**echo 'IN CNAME target' | named-rrchecker -p**](#echo~3)

- Valid input with a relative name as the CNAME target.
- Output: **IN CNAME target.**
- Relative name *target* from the input is converted to an absolute name using the default origin **.** (root).

[**echo 'IN CNAME target' | named-rrchecker -p -o origin.test**](#echo~4)

- Valid input with a relative name as the CNAME target.
- Output: **IN CNAME target.origin.test.**
- Relative name *target* from the input is converted to an absolute name using the specified origin **origin.test**

[**echo 'IN CNAME target.' | named-rrchecker -p -o origin.test**](#echo~5)

- Valid input with an absolute name as the CNAME target.
- Output: **IN CNAME target.**
- The specified origin has no influence if *target* from the input is already absolute.

## [Special characters](#Special_characters)

Special characters allowed in zone files by **RFC 1035 Section 5.1** <https://datatracker.ietf.org/doc/html/rfc1035.html#section-5.1> are accepted.

[**echo 'IN CNAME t\\097r\\get\\.' | named-rrchecker -p -o origin.test**](#echo~6)

- Valid input with backslash escapes.
- Output: **IN CNAME target\\..origin.test.**
- **\\097** denotes an ASCII value in decimal, which, in this example, is the character **a**.
- **\\g** is converted to a plain **g** because the **g** character does not have a special meaning and so the **\\** prefix does nothing in this case.
- **\\.** denotes a literal ASCII dot (here as a part of the CNAME target name). Special meaning of **.** as the DNS label separator was disabled by the preceding **\\** prefix.

[**echo 'IN CNAME @' | named-rrchecker -p -o origin.test**](#echo~7)

- Valid input with **@** used as a reference to the specified origin.
- Output: **IN CNAME origin.test.**

[**echo 'IN CNAME \\@' | named-rrchecker -p -o origin.test**](#echo~8)

- Valid input with a literal **@** character (escaped).
- Output: **IN CNAME \\@.origin.test.**

[**echo 'IN CNAME prefix.@' | named-rrchecker -p -o origin.test**](#echo~9)

- Valid input with **@** used as a reference to the specifed origin.
- Output: **IN CNAME prefix.\\@.origin.test.**
- **@** has special meaning only if it is free-standing.

[**echo 'IN A 192.0.2.1; comment' | named-rrchecker -p**](#echo~10)

- Valid input with a trailing comment. Note the lack of whitespace before the start of the comment.
- Output: **IN A 192.0.2.1**

For multi-line examples see the next section.

## [Multi-token records](#Multi)

[**echo -e 'IN TXT two words \\n' | named-rrchecker -p**](#echo~11)

- Valid TXT RR with two unquoted words and trailing whitespace.
- Output: **IN TXT "two" "words"**
- Two unquoted words in the input are treated as two *<character-string>*s per **RFC 1035 Section 3.3.14** <https://datatracker.ietf.org/doc/html/rfc1035.html#section-3.3.14>.
- Trailing whitespace is omitted from the last *<character-string>*.

[**echo -e 'IN TXT "two words" \\n' | named-rrchecker -p**](#echo~12)

- Valid TXT RR with one *character-string* and trailing whitespace.
- Output: **IN TXT "two words"**

[**echo -e 'IN TXT "problematic newline\\n"' | named-rrchecker -p**](#echo~13)

•

Invalid input - the closing **"** is not detected before the end of the line.

[**echo 'IN TXT "with newline\\010"' | named-rrchecker -p**](#echo~14)

- Valid input with an escaped newline character inside *character-string*.
- Output: **IN TXT "with newline\\010"**

[**echo -e 'IN TXT ( two\\nwords )' | named-rrchecker -p**](#echo~15)

- Valid multi-line input with line continuation allowed inside optional parentheses in the RDATA field.
- Output: **IN TXT "two" "words"**

[**echo -e 'IN TXT ( two\\nwords ; misplaced comment )' | named-rrchecker -p**](#echo~16)

•

Invalid input - comments, starting with ";", are ignored by the parser, so the closing parenthesis should be before the semicolon.

[**echo -e 'IN TXT ( two\\nwords ; a working comment\\n )' | named-rrchecker -p**](#echo~17)

- Valid input - the comment is terminated with a newline.
- Output: **IN TXT "two" "words"**

[**echo 'IN HTTPS 1 . alpn="h2,h3"' | named-rrchecker -p**](#echo~18)

- Valid HTTPS record
- Output: **IN HTTPS 1 . alpn="h2,h3"**

[**echo -e 'IN HTTPS ( 1 \\n . \\n alpn="dot")port=853' | named-rrchecker -p**](#echo~19)

- Valid HTTPS record with individual sub-fields split across multiple lines using **RFC 1035 Section 5.1** <https://datatracker.ietf.org/doc/html/rfc1035.html#section-5.1> parentheses syntax to group data that crosses a line boundary.
- Note the missing whitespace between the closing parenthesis and adjacent tokens.
- Output: **IN HTTPS 1 . alpn="dot" port=853**

## [Unknown type handling](#Unknown_type_handling)

[**echo 'IN A 192.0.2.1' | named-rrchecker -u**](#echo~20)

- Valid input in **RFC 1035** <https://datatracker.ietf.org/doc/html/rfc1035.html> format.
- Output in **RFC 3957** <https://datatracker.ietf.org/doc/html/rfc3957.html> format: **CLASS1 TYPE1 \\# 4 C0000201**

[**echo 'CLASS1 TYPE1 \\# 4 C0000201' | named-rrchecker -p**](#echo~21)

- Valid input in **RFC 3597** <https://datatracker.ietf.org/doc/html/rfc3597.html> format.
- Output in **RFC 1035** <https://datatracker.ietf.org/doc/html/rfc1035.html> format: **IN A 192.0.2.1**

[**echo 'IN A \\# 4 C0000201' | named-rrchecker -p**](#echo~22)

- Valid input with class and type in **RFC 1035** <https://datatracker.ietf.org/doc/html/rfc1035.html> format and rdata in **RFC 3597** <https://datatracker.ietf.org/doc/html/rfc3597.html> format.
- Output in **RFC 1035** <https://datatracker.ietf.org/doc/html/rfc1035.html> format: **IN A 192.0.2.1**

[**echo 'IN HTTPS 1 . key3=\\001\\000' | named-rrchecker -p**](#echo~23)

- Valid input with **RFC 9460** <https://datatracker.ietf.org/doc/html/rfc9460.html> syntax for an unknown *key3* field. Syntax **\\001\\000** produces two octets with values 1 and 0, respectively.
- Output: **IN HTTPS 1 . port=256**
- *key3* matches the standardized key name *port*.
- Octets 1 and 0 were decoded as integer values in big-endian encoding.

[**echo 'IN HTTPS 1 . key3=\\001' | named-rrchecker -p**](#echo~24)

•

Invalid input - the length of the value for *key3* (i.e. port) does not match the known standard format for that parameter in the SVCB RRTYPE.

[**echo 'IN HTTPS 1 . port=\\001\\000' | named-rrchecker -p**](#echo~25)

•

Invalid input - the key *port*, when specified using its standard mnemonic name, **must** use standard key-specific syntax.

## [Meta values](#Meta_values)

[**echo 'IN AXFR' | named-rrchecker**](#echo~26)

•

Invalid input - AXFR is a meta type, not a genuine RRTYPE.

[**echo 'ANY A 192.0.2.1' | named-rrchecker**](#echo~27)

•

Invalid input - ANY is meta class, not a true class.

[**echo 'A 192.0.2.1' | named-rrchecker**](#echo~28)

•

Invalid input - the class field is missing, so the parser would try and fail to interpret the RRTYPE A as the class.

# [RETURN CODES](#RETURN_CODES)

**0**

The whole input was parsed as one syntactically valid resource record.

**1**

The input is not a syntactically valid resource record, or the given type is not supported, or either/both class and type are meta-values, which should not appear in zone files.

# [SEE ALSO](#SEE_ALSO)

**RFC 1034** <https://datatracker.ietf.org/doc/html/rfc1034.html>, **RFC 1035** <https://datatracker.ietf.org/doc/html/rfc1035.html>, **RFC 3957** <https://datatracker.ietf.org/doc/html/rfc3957.html>, [**named(8)**](/man/os/bind/named.8) <#std-iscman-named>.

# [Author](#Author)

Internet Systems Consortium

# [Copyright](#Copyright)

2026, Internet Systems Consortium

2026-11-05 9.20.30

---

Document: named-rrchecker(1) from bind 9.20.30-r1 (Chainguard OS)
Source: https://gitlab.isc.org/isc-projects/bind9.git