The nsdiff program examines the old and new versions of a DNS zone, and outputs the differences as a script for use by BIND's nsupdate program. It provides a bridge between static zone files and dynamic updates.

If you use BIND 9.7 or 9.8, you can use nsdiff as an alternative to the DNSSEC inline-signing feature which appeared in BIND 9.9. The server updates the DNSSEC records dynamically, but you can continue to manage the unsigned static zone file as before and use `nsdiff | nsupdate` to push changes to the server.

There are other situations where you have a zone which is partly dynamic and partly static, for example, a reverse DNS zone mostly updated by a DHCP server, which also has a few static entries. You can use nsdiff to update the static part of the zone.

To run nsdiff you need perl-5.10 or newer, and BIND version 9.7 or newer, specifically the dig, named-compilezone, and nsupdate utilities.

Documentation

The nsdiff homepage is http://dotat.at/prog/nsdiff/

Read the nsdiff manual: http://dotat.at/prog/nsdiff/nsdiff.html

Code

Download the bare perl source: http://dotat.at/prog/nsdiff/nsdiff

Download the full source archives:

• http://dotat.at/prog/nsdiff/nsdiff-1.52.tar.xz

• http://dotat.at/prog/nsdiff/nsdiff-1.52.tar.gz

• http://dotat.at/prog/nsdiff/nsdiff-1.52.zip

Source repositories

You can clone or browse the repository from:

• git://dotat.at/nsdiff.git

• http://dotat.at/cgi/git/nsdiff.git

• https://github.com/fanf2/nsdiff.git

• https://git.csx.cam.ac.uk/x/ucs/ipreg/nsdiff.git

Please send bug reports or patches to me at <[email protected]>.

You may do anything with nsdiff. It has no warranty. http://creativecommons.org/publicdomain/zero/1.0/