diff --git a/roles/dns/master/templates/zone.makefile b/roles/dns/master/templates/zone.makefile
index 3e3006c..ed8eeb9 100644
--- a/roles/dns/master/templates/zone.makefile
+++ b/roles/dns/master/templates/zone.makefile
@@ -13,6 +13,7 @@ ${dest}/${db_file}: ${dest}/${db_file}.unchecked
 	named-compilezone -o "$@" {{ domain | quote }} "$<";
 
 ${dest}/${signed_file}: ${dest}/${db_file}
+	if [[ "$(dir $<)" != "$(dir $@)" ]]; then echo "directories not equal" > /dev/stderr; exit 1; fi
 	dnssec-signzone \
 		-3 $$(head -c 1000 /dev/urandom | sha1sum | cut -b 1-16) \
 		-a \