diff --git a/lib/puppet/type/resource_record.rb b/lib/puppet/type/resource_record.rb
index 3af5bb0..655d722 100644
--- a/lib/puppet/type/resource_record.rb
+++ b/lib/puppet/type/resource_record.rb
@@ -48,6 +48,10 @@ Puppet::Type.newtype(:resource_record) do
     defaultto 'update'
   end
 
+  newparam(:keyfile) do
+    desc 'Keyfile used to update the record'
+  end
+
   newparam(:hmac) do
     desc 'The HMAC type of the update key'
     defaultto 'HMAC-SHA1'
diff --git a/lib/puppet_bind/provider/nsupdate.rb b/lib/puppet_bind/provider/nsupdate.rb
index 1a1b3ef..389da17 100644
--- a/lib/puppet_bind/provider/nsupdate.rb
+++ b/lib/puppet_bind/provider/nsupdate.rb
@@ -52,6 +52,8 @@ module PuppetBind
         file.close
         if keyed?
           nsupdate('-y', tsig_param, file.path)
+        elsif keyfile?
+          nsupdate('-k', kfile, file.path)
         else
           nsupdate(file.path)
         end
@@ -106,6 +108,14 @@ module PuppetBind
         resource[:keyname]
       end
 
+      def kfile
+        resource[:keyfile]
+      end
+
+      def keyfile?
+        !kfile.nil?
+      end
+
       def hmac
         resource[:hmac]
       end