diff --git a/java/google/registry/tools/server/GenerateZoneFilesAction.java b/java/google/registry/tools/server/GenerateZoneFilesAction.java
index 893be5bbc..86cdcc33e 100644
--- a/java/google/registry/tools/server/GenerateZoneFilesAction.java
+++ b/java/google/registry/tools/server/GenerateZoneFilesAction.java
@@ -195,7 +195,8 @@ public class GenerateZoneFilesAction implements Runnable, JsonActionRunner.JsonA
       // Domains never change their tld, so we can check if it's from the wrong tld right away.
       if (tlds.contains(domain.getTld())) {
         domain = loadAtPointInTime(domain, exportTime).now();
-        if (domain != null) {  // A null means the domain was deleted (or not created) at this time.
+        // A null means the domain was deleted (or not created) at this time.
+        if (domain != null && domain.shouldPublishToDns()) {
           String stanza = domainStanza(domain, exportTime);
           if (!stanza.isEmpty()) {
             emit(domain.getTld(), stanza);
diff --git a/javatests/google/registry/tools/server/GenerateZoneFilesActionTest.java b/javatests/google/registry/tools/server/GenerateZoneFilesActionTest.java
index 46fdee9ee..12d10eacf 100644
--- a/javatests/google/registry/tools/server/GenerateZoneFilesActionTest.java
+++ b/javatests/google/registry/tools/server/GenerateZoneFilesActionTest.java
@@ -37,6 +37,7 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import google.registry.model.domain.secdns.DelegationSignerData;
+import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.host.HostResource;
 import google.registry.testing.FakeClock;
 import google.registry.testing.mapreduce.MapreduceTestCase;
@@ -77,12 +78,24 @@ public class GenerateZoneFilesActionTest extends MapreduceTestCase<GenerateZoneF
     persistResource(newDomainResource("ns-only.tld").asBuilder()
         .addNameservers(nameservers)
         .build());
+    persistResource(newDomainResource("ns-only-client-hold.tld").asBuilder()
+        .addNameservers(nameservers)
+        .setStatusValues(ImmutableSet.of(StatusValue.CLIENT_HOLD))
+        .build());
+    persistResource(newDomainResource("ns-only-pending-delete.tld").asBuilder()
+        .addNameservers(nameservers)
+        .setStatusValues(ImmutableSet.of(StatusValue.PENDING_DELETE))
+        .build());
+    persistResource(newDomainResource("ns-only-server-hold.tld").asBuilder()
+        .addNameservers(nameservers)
+        .setStatusValues(ImmutableSet.of(StatusValue.SERVER_HOLD))
+        .build());
+    // These should be ignored; contact and applications aren't in DNS, hosts need to be from the
+    // same tld and have ip addresses, and domains need to be from the same tld and have hosts (even
+    // in the case where domains contain DS data).
     persistResource(newDomainResource("ds-only.tld").asBuilder()
         .setDsData(ImmutableSet.of(DelegationSignerData.create(1, 2, 3, new byte[] {0, 1, 2})))
         .build());
-
-    // These should be ignored; contact and applications aren't in DNS, hosts need to be from the
-    // same tld and have ip addresses, and domains need to be from the same tld and have hosts.
     persistActiveContact("ignored_contact");
     persistActiveDomainApplication("ignored_application.tld");
     persistActiveHost("ignored.host.tld");  // No ips.
diff --git a/javatests/google/registry/tools/server/testdata/tld.zone b/javatests/google/registry/tools/server/testdata/tld.zone
index bf6cb6a23..fe0ea3661 100644
--- a/javatests/google/registry/tools/server/testdata/tld.zone
+++ b/javatests/google/registry/tools/server/testdata/tld.zone
@@ -6,8 +6,6 @@ ns.bar.tld 3600 IN AAAA 0:0:0:0:0:0:0:1
 ns-only.tld 180 IN NS ns.foo.tld.
 ns-only.tld 180 IN NS ns.bar.tld.
 
-ds-only.tld 86400 IN DS 1 2 3 000102
-
 ns-and-ds.tld 180 IN NS ns.foo.tld.
 ns-and-ds.tld 180 IN NS ns.bar.tld.
 ns-and-ds.tld 86400 IN DS 1 2 3 000102