The SOA record in all of our zone files looks like this:

@ 3600 SOA manus.authdns.ripe.net. dns.ripe.net. ___DO_NOT_EDIT_SERIAL___ 3600 600 864000 3600

When the zone files are copied to the destination, we use sed to replace the string DO_NOT_EDIT_SERIAL with the current unix time.

If I check this zone file with BIND's named-checkzone, it rightly complains about the serial field of the SOA record, because it's not valid:

% named-checkzone ripe.net.{,zone}
dns_rdata_fromtext: ripe.net.zone:1: near '___DO_NOT_EDIT_SERIAL___': not a valid number
zone ripe.net/IN: loading from master file ripe.net.zone failed: not a valid number
zone ripe.net/IN: not loaded due to errors.

However, NSD's nsd-checkzone doesn't complain:

% nsd-checkzone ripe.net.{,zone}
zone ripe.net. is ok

This looks like a bug in nsd-checkzone. This is from NSD 4.3.9.