diff --git a/dnsapi/README.md b/dnsapi/README.md
index d3dff12a..a74e0404 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -100,6 +100,10 @@ https://github.com/Neilpang/acme.sh/wiki/How-to-use-OVH-domain-api
 
 ## 7. Use nsupdate to automatically issue cert
 
+If `nsupdate -l` already works for the domain in question, you are all set:
+neither preparation nor environment variables are required.
+Otherwise, follow these instructions:
+
 First, generate a key for updating the zone
 ```
 b=$(dnssec-keygen -a hmac-sha512 -b 512 -n USER -K /tmp foo)
diff --git a/dnsapi/dns_nsupdate.sh b/dnsapi/dns_nsupdate.sh
index 7acb2ef7..4dcbcded 100755
--- a/dnsapi/dns_nsupdate.sh
+++ b/dnsapi/dns_nsupdate.sh
@@ -7,7 +7,6 @@ dns_nsupdate_add() {
   fulldomain=$1
   txtvalue=$2
   _checkKeyFile || return 1
-  [ -n "${NSUPDATE_SERVER}" ] || NSUPDATE_SERVER="localhost"
   # save the dns server and key to the account conf file.
   _saveaccountconf NSUPDATE_SERVER "${NSUPDATE_SERVER}"
   _saveaccountconf NSUPDATE_KEY "${NSUPDATE_KEY}"
@@ -29,7 +28,6 @@ EOF
 dns_nsupdate_rm() {
   fulldomain=$1
   _checkKeyFile || return 1
-  [ -n "${NSUPDATE_SERVER}" ] || NSUPDATE_SERVER="localhost"
   _info "removing ${fulldomain}. txt"
   nsupdate -k "${NSUPDATE_KEY}" <<EOF
 server ${NSUPDATE_SERVER}
@@ -47,6 +45,10 @@ EOF
 ####################  Private functions below ##################################
 
 _checkKeyFile() {
+  [ -n "${NSUPDATE_SERVER}" ] || NSUPDATE_SERVER="localhost"
+  if [ "${NSUPDATE_SERVER}" = "localhost" -a -z "${NSUPDATE_KEY}" ]; then
+    NSUPDATE_KEY=/var/run/named/session.key
+  fi
   if [ -z "${NSUPDATE_KEY}" ]; then
     _err "you must specify a path to the nsupdate key file"
     return 1