DNS Zone File Analyzer
Parse a BIND zone file and check it: CNAME conflicts, missing glue, trailing-dot mistakes, SPF, DMARC and DKIM, DNSSEC records and takeover-prone aliases. Runs in your browser.
Runs in your browser Your input never leaves your device.
Paste a zone file (BIND master file format, as exported by BIND, many DNS hosts and dig axfr). It is read in your browser and nothing is uploaded or looked up. Records in $INCLUDE files and $GENERATE lines are not expanded.
Findings
Records
| Name | TTL | Type | Data | Line |
|---|
What is checked
Zone health the way BIND checks it: one SOA at the apex, NS records, CNAME next to other data, several CNAMEs, NS and MX targets with no address or pointing to a CNAME, records outside the zone, names missing a trailing dot, glue for delegations and records hidden below them. Plus: CNAME chains, loops and dangling targets, duplicates, TTL mismatches and very low TTLs, private addresses, SOA timers, a single name server, wildcards, missing CAA. Email authentication: several SPF records, +all, ?all or no all, the 10-lookup limit, missing or weak DMARC, short or revoked DKIM keys. DNSSEC records with deprecated algorithms or SHA-1 digests and expired signatures, odd CAA tags, SSHFP with SHA-1 only, aliases to third-party services that can be taken over, null MX mistakes. Plus the syntax of every record.
Findings describe the text you pasted, not what your name servers answer. Run named-checkzone on the server for the final word.
Report a problem with this tool
About this tool
A zone file is the source of truth for what a domain publishes, and the mistakes in it are the same few every time: a CNAME next to other records, a name written without its trailing dot so the zone name is appended twice, name servers with no address, two SPF records, or an alias to a hosting service that no longer exists. This tool reads a BIND-format zone file in your browser, shows every record with its effective TTL, and applies a numbered ruleset. The parser follows BIND: parentheses, comments, $ORIGIN and $TTL, blank owners, TTL units such as 1h30m, class and TTL in either order, escapes, and the BIND rule for records with no TTL. The parser was compared with named-compilezone on 500 random zones (IN class, the common record types) and on a list of edge cases (TTL range, names, digest lengths, CAA, generic rdata, directives). The critical zone checks (SOA, NS, CNAME and other data, singletons, NS and MX targets with no address) were compared with named-checkzone; a few BIND checks, such as DNAME conflicts, are not implemented. Beyond BIND it checks SPF (several records, +all, ?all, the 10-lookup limit), DMARC, DKIM key length, DNSSEC algorithms and expired signatures, CAA tags, SSHFP, SOA timers against RFC 1912, TTL mismatches, private addresses, wildcards and aliases to third-party services that can be taken over. It cannot follow $INCLUDE or expand $GENERATE, and it reads text only: it never queries DNS.
How to use it
- Paste the zone file or load it. Add the zone name if the file has no $ORIGIN.
- Read the findings first. Critical ones are what BIND would refuse to load; high ones are likely outages or mail failures.
- Check the record table to see names and TTLs after $ORIGIN and TTL defaults are applied.
- Copy the Markdown summary into your notes or ticket.
Common problems
- Names show the zone name twice
- A name was written without the trailing dot, so the zone name was appended. Write ns1.example.com. with the final dot, or just ns1.
- The zone name is unknown
- The file has no $ORIGIN and no SOA with an absolute owner. Type the zone name in the box above.
- A record is reported as out of zone
- Its name is not inside the zone. BIND ignores such records. Check for a stray $ORIGIN or a missing trailing dot.