Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any tools available to automatically detect (and optionally correct) CNAME chains in BIND zone files?

I am trying to clean up a rather large zone file (15,000+ resource records) so I'm looking for tools that can perform static analysis to detect common problems and help me move towards best practices.

share|improve this question
maybe grep CNAME ? – Sandman4 Jul 14 '12 at 19:20
@Sandman4 grep is good for finding single CNAME entries, but I want to avoid doing a manual grep (or dig) for each of those 500 records to see if they chain to another CNAME. – Nic Jul 14 '12 at 19:26
does bind's checkzone checks for CNAME chains ? - It does for MX and SRV, but can't see for CNAME... – Sandman4 Jul 14 '12 at 21:38
named-checkzone does not check for CNAME chains, because they are still technically valid, whereas MX records must point to an A record according to RFC2181. – Nic Jul 14 '12 at 22:02

I have not seen anything that exists to do this. It looks like the sort of thing you'd just need to write a Perl (or Python, etc.) script for.

Easiest would just be to go through all of the lines and make a hash table of A records. Then go through the file and for each CNAME record, do a hash lookup for the A record. If it's not found, then flag that line as not being a valid CNAME entry.

It should be very straightforward.

share|improve this answer

I found a commercial program called DNS Expert from "Men & Mice" can thoroughly analyze a DNS zone using many predefined rules for standards compliance and best practices. One of those diagnostic rules allows it to detect CNAME chains.

However, it can only scan live servers with AXFR enabled. There doesn't appear to be any way to scan a zonefile that has been copied to the local harddrive. It hasn't been updated since 2006, but DNS hasn't changed in that time either. :-)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.