--- title: "render zone file · RUAL Documentation" description: "Render a complete BIND zone file from stored records, with the decision report that belongs in front of a push." canonical: https://docs.rual.nl/block-types/dns/dnszone_render language: en --- [Cluster](https://docs.rual.nl/cluster) [Blocks](https://docs.rual.nl/block-types) [Interfaces](https://docs.rual.nl/interfaces) [Blueprints](https://docs.rual.nl/blueprints) [Tutorials](https://docs.rual.nl/tutorials) [Home automation](https://docs.rual.nl/home-automation) [Examples](https://docs.rual.nl/examples) [Reference](https://docs.rual.nl/reference) [Architecture](https://docs.rual.nl/architecture) [Troubleshooting](https://docs.rual.nl/troubleshooting) Other # render zone file This block is part of the [`dns`](https://docs.rual.nl/block-types/dns) group and was last modified in core [`v15.0.0`](https://docs.rual.nl/core-versions/150000). Render a complete BIND zone file from stored records, with the decision report that belongs in front of a push. - flow `flow` - Zone required `value` The origin being rendered, for example deverence.nl. - Records required `array` The records, as the store holds them. For a group member, the group's record set. - SOA required `object` This apex's own SOA timers: mname, rname, refresh, retry, expire, minimum. - Nameservers `array` This apex's own existing NS set. Ours are added alongside. - Group base zone `value` Set this to render a group member: the records are the group's and belong to this base apex. - Rules `array` The group's policy: {action, owner, type, value_contains, slot, why}. First match wins. - Own records `array` This member's own versions of the per-apex records, each carrying the slot it fills. - Extra records `array` Records that exist only on this apex and have no counterpart in the base. - Slots not applicable `object` Slot name to the reason this domain will never fill it. A recorded decision reads differently from a gap. - Strict `condition` Refuse the render outright when a per-apex slot is neither filled nor explained. - Flatten out-of-zone ALIAS `condition` Resolve ALIAS targets outside this zone to addresses. They go stale when the target moves, so every one is reported with the time it was resolved. In-zone targets never need this. - Allow routing policies `condition` Emit routing-policy records commented out instead of refusing. - Serial `number` Stamp this serial instead of the epoch at render time. - Our nameservers `value` Comma-separated. The default is a placeholder (ns1.example.com, ns2.example.com, ns3.example.com) : set your own authoritative nameservers. Default `ns1.example.com,ns2.example.com,ns3.example.com` - Header `value` Comment lines above the origin. Each line is prefixed with a semicolon if it has none. - Negative TTL `number` Seconds a resolver may cache 'this name does not exist'. Written BOTH as the SOA's own TTL and as its MINIMUM field, because RFC 2308 caches a negative answer for the lower of the two : setting MINIMUM alone does nothing while the SOA inherits a smaller $TTL. Default 900. Default `900` - flow `flow` - Success `condition` True when the zone rendered. - Zone `value` The origin, without its trailing dot. - Zone file `value` The complete zone file, ready to check and push. - Serial `number` The serial stamped into the file. - Records `array` The effective record set : for a group member, the composed one. - Count `number` How many record sets the zone carries. - Report `object` Every decision the render made: rewritten, noted, flattened and refused. Show this before a push is confirmed. - Aliases `array` Every ALIAS, with its scope, what it resolved to and : out of zone : when. - Slots `array` Per-apex slots, each with state filled, not-applicable or empty. - Unfilled slots `array` Slots nobody has answered for. A zone with any of these must not be pushed. - Complete `condition` True when every per-apex slot is filled or explained. Wire this into the push. - Error `value` Why the render was refused. Renders stored records into a complete BIND zone file on zone_file. PURE: no network, no server, no writes : same store state, same bytes apart from the serial. That separation is what makes a resync a re-render instead of a diff-repair, and what lets the UI show exactly what will land before anything does. ONE BLOCK, TWO SHAPES. Given records alone, it renders that zone. Given base_zone as well, the records are a zone GROUP's and this apex is a member: group semantics run first and the composed set comes back on the records pin. In a group, each value takes the first matching entry in rules ({action, owner, type, value_contains, slot, why}; a missing field is a wildcard), falling back to the record's own policy : 'verbatim' (default), 'rewrite' (re-aim a target naming the base apex at this member's, REFUSING if it changed nothing), 'per-apex' (drop the base value; the record becomes a slot this member fills from its own records) or 'note' (copy but flag). overrides are this member's own slot fills, extra are records existing only on this apex, slots_na is {slot: reason}. A slot neither filled nor in slots_na is EMPTY: complete comes back false and, with strict on, the render is refused. ALIAS has no BIND equivalent and the two cases differ completely. An IN-ZONE target (deverence.com -> www.deverence.com) is answered from the zone's OWN RECORDS: deterministic, no resolver, never stale, and it REFUSES if the target names nothing in the zone rather than emitting a record that is silently missing. An OUT-OF-ZONE target (an ELB, a CloudFront name) needs a live lookup, so it requires flatten_alias and comes back with a resolved_at timestamp, because it goes stale when the target moves. The apex NS set becomes the zone's existing nameservers PLUS our_nameservers (default the canonical trio). The serial is the epoch at render time unless a serial is passed. | `render zone` | | --- | | `zone file` | | `render group member` | | `dupping` | A typical wiring for [render zone file](https://docs.rual.nl/block-types/dns/dnszone_render): a [function trigger](https://docs.rual.nl/block-types/globals/trigger_custom_function) starts the flow; [value](https://docs.rual.nl/block-types/value/value_default) feeds the `zone` pin; [with values](https://docs.rual.nl/block-types/array/array_of_values) feeds the `records` pin; [new object](https://docs.rual.nl/block-types/object/object_new_fields) feeds the `soa` pin; the `flow` out pin feeds [debug](https://docs.rual.nl/block-types/state%2520ui/state_debug). [![Studio canvas example for the render zone file block: typical wiring for render zone file.](https://docs.rual.nl/canvas-examples/dnszone_render.png)](https://docs.rual.nl/canvas-examples/dnszone_render.png?v=3) ## Used in these guides These documentation pages use or explain this block: - [DNS Zone Blocks](https://docs.rual.nl/reference/dns-blocks) ## Version history Introduced in [`v15.0.0`](https://docs.rual.nl/core-versions/150000). - [Back to `dns`](https://docs.rual.nl/block-types/dns): Return to the main group to view all sub-groups - [Back to `DNS zones`](https://docs.rual.nl/block-types/dns?group=DNS%20zones): Return to the group to view all blocks within this group Was this page helpful? [Tell us what to improve](https://docs.rual.nl/support) · RUAL Docs is an integral component of the [RUAL ecosystem](https://rual.nl)