For example, with this dnssec-policy.conf: ################################################################################ ## Do not edit this file, it is autogenerated, edit dnssec-policy.conf.proto ## ################################################################################ policy default-dnssec { directory "/etc/namedb/keys"; algorithm rsasha512; key-size zsk 1024; key-size ksk 2048; pre-publish zsk 2w; post-publish zsk 2w; roll-period zsk 2mo; roll-period ksk 0; coverage 6mo; }; algorithm-policy RSASHA1 { post-publish zsk 2w; pre-publish zsk 2w; roll-period zsk 2mo; roll-period ksk 0; coverage 6mo; }; zone 99example.com { policy default-dnssec; }; Output when run: # dnssec-keymgr /usr/local/etc/namedb/dnssec-policy.conf:23:syntax error near '99' ... never exits. Domains beginning with numbers do exist, hence the script should be able to work with them.