---
title: "validate zone on the nameservers · RUAL Documentation"
description: "Run named-checkzone on every nameserver. Writes nothing anywhere, on any node."
canonical: https://docs.rual.nl/block-types/dns/dnszone_check
language: en
---

[Cluster](https://docs.rual.nl/cluster)

[Blocks](https://docs.rual.nl/block-types)

[Interfaces](https://docs.rual.nl/interfaces)

[Blueprints](https://docs.rual.nl/blueprints)

[Tutorials](https://docs.rual.nl/tutorials)

[Home automation](https://docs.rual.nl/home-automation)

[Examples](https://docs.rual.nl/examples)

[Reference](https://docs.rual.nl/reference)

[Architecture](https://docs.rual.nl/architecture)

[Troubleshooting](https://docs.rual.nl/troubleshooting)

Other

# validate zone on the nameservers

This block is part of the [`dns`](https://docs.rual.nl/block-types/dns) group and was last modified in core [`v15.0.0`](https://docs.rual.nl/core-versions/150000).

Run named-checkzone on every nameserver. Writes nothing anywhere, on any node.

- flow `flow`

- Zone required `value` The zone name, for example deverence.nl.

- Zone file required `value` The rendered zone file, exactly as it would be pushed.

- Nameservers required `array` Each {name, host, port, user, key_path, known_hosts_path}. Paths only : never key material.

- flow `flow`

- Success `condition` True when every node could be asked. Whether they passed is on the passed pin.

- Zone `value` The zone that was validated.

- Passed everywhere `condition` True only when named-checkzone passed on every node. This is the gate the push needs.

- Results `array` Per node: name, host, ok, output, exit_code, checksum, zone.

- Checksum `value` sha256 of the exact bytes checked. The push matches on this.

- Passed count `number` How many nodes accepted the file.

- Node count `number` How many nodes were asked.

- Error `value` Why the check could not run at all.

Runs named-checkzone for this zone file on EVERY nameserver in the nodes list and reports per node. It never writes: the file is handed to the parser on stdin and discarded. This is a separate fan-out ahead of any write, not a per-node try-and-see, because a DNS server serving a syntactically valid but truncated zone is worse than one serving yesterday's : so 'does this parse everywhere' is answered in full before 'shall we replace anything' is asked. passed comes back true only when every node passed. results carries {name, host, ok, output, exit_code, checksum, zone} per node, and checksum is a sha256 of the exact bytes checked: dnszone_push demands a passing result with a MATCHING checksum for every node it is about to write to, so a flow cannot render, check, edit and then push a different file. Each node is {name, host, port, user, key_path, known_hosts_path}. Key MATERIAL must never appear on the pin : only paths : and the block refuses a node object carrying private_key, key, password, passphrase or secret. Refuses a file still carrying the @SERIAL@ placeholder, since those would not be the bytes pushed.

| `named-checkzone` |
| --- |
| `validate zone` |
| `check zone` |

A typical wiring for [validate zone on the nameservers](https://docs.rual.nl/block-types/dns/dnszone_check): a [function trigger](https://docs.rual.nl/block-types/globals/trigger_custom_function) starts the flow; [value](https://docs.rual.nl/block-types/value/value_default) feeds the `zone` pin; [value](https://docs.rual.nl/block-types/value/value_default) feeds the `zone_file` pin; [with values](https://docs.rual.nl/block-types/array/array_of_values) feeds the `nodes` pin; the `flow` out pin feeds [debug](https://docs.rual.nl/block-types/state%2520ui/state_debug).

[![Studio canvas example for the validate zone on the nameservers block: typical wiring for validate zone on the nameservers.](https://docs.rual.nl/canvas-examples/dnszone_check.png)](https://docs.rual.nl/canvas-examples/dnszone_check.png?v=3)

## Used in these guides

These documentation pages use or explain this block:

- [DNS Zone Blocks](https://docs.rual.nl/reference/dns-blocks)

## Version history

Introduced in [`v15.0.0`](https://docs.rual.nl/core-versions/150000).

- [Back to `dns`](https://docs.rual.nl/block-types/dns): Return to the main group to view all sub-groups

- [Back to `DNS zones`](https://docs.rual.nl/block-types/dns?group=DNS%20zones): Return to the group to view all blocks within this group

Was this page helpful? [Tell us what to improve](https://docs.rual.nl/support) · RUAL Docs is an integral component of the [RUAL ecosystem](https://rual.nl)