diff --git a/documentation/providers/axfrddns.md b/documentation/providers/axfrddns.md
index 9408f3df4..44eebb81e 100644
--- a/documentation/providers/axfrddns.md
+++ b/documentation/providers/axfrddns.md
@@ -102,11 +102,16 @@ var DSP_AXFRDDNS = NewDnsProvider("axfrddns", {
 ```
 {% endcode %}
 
+{% code title="creds.json" %}
 ```json
 {
-   nameservers = "ns1.example.tld,ns2.example.tld,ns3.example.tld,ns4.example.tld"
+  "axfrddns": {
+    "TYPE": "AXFRDDNS",
+    "nameservers": "ns1.example.tld.,ns2.example.tld.,ns3.example.tld.,ns4.example.tld."
+  }
 }
 ```
+{% endcode %}
 
 ### Primary master
 
@@ -119,11 +124,16 @@ of the zone. In that case, the IP or the name of the primary server
 must be provided in `creds.json`. With this option, a non-standard
 port might be used.
 
+{% code title="creds.json" %}
 ```json
 {
-   master = "10.20.30.40:5353"
+  "axfrddns": {
+    "TYPE": "AXFRDDNS",
+    "master": "10.20.30.40:5353"
+  }
 }
 ```
+{% endcode %}
 
 When no nameserver appears in the zone, and no default nameservers nor
 custom master are configured, the AXFR+DDNS provider will fail with
@@ -144,6 +154,37 @@ The changes will then be split in two DDNS updates, applied
 successively by the server. This will allow Knot to successfully apply
 the changes, but you will loose the atomic-update property.
 
+### Example: local testing
+
+When testing `dnscontrol` against a local nameserver, you might use
+the following minimal configuration:
+
+{% code title="creds.json" %}
+```json
+{
+  "axfrddns": {
+    "TYPE": "AXFRDDNS",
+    "master": "127.0.0.1"
+  }
+}
+```
+{% endcode %}
+
+{% code title="dnsconfig.js" %}
+```javascript
+var REG = NewRegistrar('none');
+var DNS = NewDnsProvider('axfrddns', {
+    default_ns: [
+        "ns.example.com.",
+    ],
+});
+
+D('example.com', REG, DnsProvider(DNS),
+  A('ns', '127.0.0.1')
+)
+```
+{% endcode %}
+
 
 ## Server configuration examples
 
diff --git a/providers/axfrddns/axfrddnsProvider.go b/providers/axfrddns/axfrddnsProvider.go
index e3ab8ecb1..de46eb949 100644
--- a/providers/axfrddns/axfrddnsProvider.go
+++ b/providers/axfrddns/axfrddnsProvider.go
@@ -281,16 +281,19 @@ func (c *axfrddnsProvider) GetZoneRecords(domain string, meta map[string]string)
 	var foundDNSSecRecords *models.RecordConfig
 	foundRecords := models.Records{}
 	for _, rr := range rawRecords {
-		switch rr.(type) {
-		case *dns.RRSIG,
-			*dns.DNSKEY,
-			*dns.CDNSKEY,
-			*dns.CDS,
-			*dns.NSEC,
-			*dns.NSEC3,
-			*dns.NSEC3PARAM:
+		switch rr.Header().Rrtype {
+		case dns.TypeRRSIG,
+			dns.TypeDNSKEY,
+			dns.TypeCDNSKEY,
+			dns.TypeCDS,
+			dns.TypeNSEC,
+			dns.TypeNSEC3,
+			dns.TypeNSEC3PARAM,
+			65534:
 			// Ignoring DNSSec RRs, but replacing it with a single
 			// "TXT" placeholder
+			// Also ignoring spurious TYPE65534, see:
+			// https://bind9-users.isc.narkive.com/zX29ay0j/rndc-signing-list-not-working#post2
 			if foundDNSSecRecords == nil {
 				foundDNSSecRecords = new(models.RecordConfig)
 				foundDNSSecRecords.Type = "TXT"