Are there any tools available to automatically detect (and optionally correct) CNAME chains in BIND zone files?

I am trying to clean up a rather large zone file (15,000+ resource records) so I'm looking for tools that can perform static analysis to detect common problems and help me move towards best practices.

  • maybe grep CNAME ? – Sandman4 Jul 14 '12 at 19:20
  • @Sandman4 grep is good for finding single CNAME entries, but I want to avoid doing a manual grep (or dig) for each of those 500 records to see if they chain to another CNAME. – Nic Jul 14 '12 at 19:26
  • does bind's checkzone checks for CNAME chains ? - It does for MX and SRV, but can't see for CNAME... – Sandman4 Jul 14 '12 at 21:38
  • named-checkzone does not check for CNAME chains, because they are still technically valid, whereas MX records must point to an A record according to RFC2181. – Nic Jul 14 '12 at 22:02

I have not seen anything that exists to do this. It looks like the sort of thing you'd just need to write a Perl (or Python, etc.) script for.

Easiest would just be to go through all of the lines and make a hash table of A records. Then go through the file and for each CNAME record, do a hash lookup for the A record. If it's not found, then flag that line as not being a valid CNAME entry.

It should be very straightforward.


I found a commercial program called DNS Expert from "Men & Mice" can thoroughly analyze a DNS zone using many predefined rules for standards compliance and best practices. One of those diagnostic rules allows it to detect CNAME chains.

However, it can only scan live servers with AXFR enabled. There doesn't appear to be any way to scan a zonefile that has been copied to the local harddrive. It hasn't been updated since 2006, but DNS hasn't changed in that time either. :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.