diff --git a/net-dns/bind-tools/bind-tools-9.9.2.ebuild b/net-dns/bind-tools/bind-tools-9.9.2.ebuild
--- a/net-dns/bind-tools/bind-tools-9.9.2.ebuild
+++ b/net-dns/bind-tools/bind-tools-9.9.2.ebuild
@@ -18,7 +18,7 @@ SRC_URI="ftp://ftp.isc.org/isc/bind9/${MY_PV}/${MY_P}.tar.gz"
 LICENSE="ISC BSD BSD-2 HPND JNIC RSA openssl"
 SLOT="0"
 KEYWORDS="alpha amd64 arm hppa ia64 ~mips ppc ppc64 s390 sh sparc x86 ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="doc gssapi idn ipv6 readline ssl urandom xml"
+IUSE="doc +dig dnssec gssapi idn ipv6 nsupdate readline ssl urandom xml"
 # no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
 
 DEPEND="ssl? ( dev-libs/openssl )
@@ -75,29 +75,33 @@ src_compile() {
 	local AR=$(tc-getAR)
 
 	emake AR=$AR -C lib/ || die "emake lib failed"
-	emake AR=$AR -C bin/dig/ || die "emake bin/dig failed"
-	emake AR=$AR -C bin/nsupdate/ || die "emake bin/nsupdate failed"
-	emake AR=$AR -C bin/dnssec/ || die "emake bin/dnssec failed"
+	use dig      && ( emake AR=$AR -C bin/dig/      || die "emake bin/dig failed"      )
+	use nsupdate && ( emake AR=$AR -C bin/nsupdate/ || die "emake bin/nsupdate failed" )
+	use dnssec   && ( emake AR=$AR -C bin/dnssec/   || die "emake bin/dnssec failed"   )
 }
 
 src_install() {
 	dodoc README CHANGES FAQ
 
-	cd "${S}"/bin/dig
-	dobin dig host nslookup
-	doman {dig,host,nslookup}.1
+	if use dig; then
+		cd "${S}"/bin/dig
+		dobin dig host nslookup
+		doman {dig,host,nslookup}.1
+	fi
 
-	cd "${S}"/bin/nsupdate
-	dobin nsupdate
-	doman nsupdate.1
-	if use doc; then
-		dohtml nsupdate.html
+	if use nsupdate; then
+		cd "${S}"/bin/nsupdate
+		dobin nsupdate
+		doman nsupdate.1
+		use doc && dohtml nsupdate.html
 	fi
 
-	cd "${S}"/bin/dnssec
-	dobin dnssec-keygen
-	doman dnssec-keygen.8
-	if use doc; then
-		dohtml dnssec-keygen.html
+	if use dnssec; then
+		cd "${S}"/bin/dnssec
+		for tool in dsfromkey keyfromlabel keygen revoke settime signzone verify; do
+			dobin dnssec-${tool}
+			doman dnssec-${tool}.8
+			use doc && dohtml dnssec-${tool}.html
+		done
 	fi
 }
diff --git a/net-dns/bind-tools/metadata.xml b/net-dns/bind-tools/metadata.xml
--- a/net-dns/bind-tools/metadata.xml
+++ b/net-dns/bind-tools/metadata.xml
@@ -6,8 +6,11 @@
 		<name>Christian Ruppert</name>
 	</maintainer>
 	<use>
-		<flag name="urandom">Use /dev/urandom instead of /dev/random</flag>
+		<flag name="dig">Build dig tools (dig, nslookup, host)</flag>
+		<flag name="dnssec">Build dnssec tools</flag>
+		<flag name="nsupdate">Build nsupdate</flag>
 		<flag name="gssapi">Enable gssapi support</flag>
+		<flag name="urandom">Use /dev/urandom instead of /dev/random</flag>
 	</use>
 	<longdescription>ISC's Bind DNS' server tools</longdescription>
 </pkgmetadata>