[dns-operations] Diffing tools for zones?

[Paul Hoffman]

Greetings. I used to be able to do a reasonably sane check for changed between two versions of the root zone with 'diff'. Now that the root is signed, that all goes to hell.

Are there any reasonable tools that know how to look for differences in two versions of a modern zone? By "reasonable" I mean "ignores changes in NSEC and NSEC3 records and other things that are normal in the daily operation of a signed zone".

--Paul Hoffman