diff --git a/lib/puppet/type/resource_record.rb b/lib/puppet/type/resource_record.rb
index ca1bb55..ca22283 100644
--- a/lib/puppet/type/resource_record.rb
+++ b/lib/puppet/type/resource_record.rb
@@ -42,6 +42,10 @@ Puppet::Type.newtype(:resource_record) do
     defaultto 'update'
   end
 
+  newparam(:keyfile) do
+    desc 'Keyfile used to update the record'
+  end
+
   newparam(:hmac) do
     desc 'The HMAC type of the update key'
     defaultto 'HMAC-SHA1'
diff --git a/lib/puppet_bind/provider/nsupdate.rb b/lib/puppet_bind/provider/nsupdate.rb
index 67c08c7..e7c4709 100644
--- a/lib/puppet_bind/provider/nsupdate.rb
+++ b/lib/puppet_bind/provider/nsupdate.rb
@@ -51,6 +51,8 @@ module PuppetBind
         file.close
         if keyed?
           nsupdate('-y', tsig_param, file.path)
+        elsif keyfile?
+          nsupdate('-k', kfile, file.path)
         else
           nsupdate(file.path)
         end
@@ -81,6 +83,14 @@ module PuppetBind
         resource[:keyname]
       end
 
+      def kfile
+        resource[:keyfile]
+      end
+
+      def keyfile?
+        !kfile.nil?
+      end
+
       def hmac
         resource[:hmac]
       end