diff --git a/src/mgmt/management-tool.cpp b/src/mgmt/management-tool.cpp
index 9925aca..c6fc51e 100644
--- a/src/mgmt/management-tool.cpp
+++ b/src/mgmt/management-tool.cpp
@@ -288,11 +288,8 @@
   rrset.setVersion(re.getVersion());
   rrset.setData(data->wireEncode());
 
-  if (m_dbMgr.find(rrset)) {
-    throw Error("Duplicate " + boost::lexical_cast<std::string>(rrset));
-  }
+  checkRrsetVersion(rrset);
   NDNS_LOG_INFO("Added " << rrset);
-
   m_dbMgr.insert(rrset);
 }
 
@@ -388,9 +385,7 @@
   rrset.setVersion(re.getVersion());
   rrset.setData(data->wireEncode());
 
-  if (m_dbMgr.find(rrset)) {
-    throw Error("Duplicate " + boost::lexical_cast<std::string>(rrset));
-  }
+  checkRrsetVersion(rrset);
   NDNS_LOG_INFO("Added " << rrset);
   m_dbMgr.insert(rrset);
 }
@@ -636,5 +631,22 @@
   return true;
 }
 
+void
+ManagementTool::checkRrsetVersion(const Rrset& rrset)
+{
+  Rrset originalRrset(rrset);
+  if (m_dbMgr.find(originalRrset)) {
+    // update only if rrset has a newer version
+    if (originalRrset.getVersion() == rrset.getVersion()) {
+      throw Error("Duplicate: " + boost::lexical_cast<std::string>(originalRrset));
+    }
+    else if (originalRrset.getVersion() > rrset.getVersion()) {
+      throw Error("Newer version exists: " + boost::lexical_cast<std::string>(originalRrset));
+    }
+
+    m_dbMgr.remove(originalRrset);
+  }
+}
+
 } // namespace ndns
 } // namespace ndn
diff --git a/src/mgmt/management-tool.hpp b/src/mgmt/management-tool.hpp
index 54a1407..69fd355 100644
--- a/src/mgmt/management-tool.hpp
+++ b/src/mgmt/management-tool.hpp
@@ -225,6 +225,11 @@
   bool
   matchCertificate(const Name& certName, const Name& identity);
 
+  /** @brief determine whether an older version of the rrset exists
+   */
+  void
+  checkRrsetVersion(const Rrset& rrset);
+
 private:
   KeyChain& m_keyChain;
   DbMgr m_dbMgr;
diff --git a/tests/unit/mgmt/management-tool.cpp b/tests/unit/mgmt/management-tool.cpp
index 3f18807..f5137e1 100644
--- a/tests/unit/mgmt/management-tool.cpp
+++ b/tests/unit/mgmt/management-tool.cpp
@@ -656,12 +656,11 @@
 
 BOOST_FIXTURE_TEST_CASE(AddRrSet6, ManagementToolFixture)
 {
-  //check using user provided certificate
+  //check invalid output
   Name parentZoneName("/ndns-test");
   Name zoneName = Name(parentZoneName).append("child-zone");
   m_tool.createZone(zoneName, parentZoneName);
 
-  //check invalid output
   Name content = "invalid data packet";
   std::string output = TEST_CERTDIR.string() + "/ss.cert";
   ndn::io::save(content, output);
@@ -669,6 +668,40 @@
   BOOST_CHECK_THROW(m_tool.addRrSet(zoneName, output), ndns::ManagementTool::Error);
 }
 
+BOOST_FIXTURE_TEST_CASE(AddRrSet7, ManagementToolFixture)
+{
+  //check version control
+  Name parentZoneName("/ndns-test");
+  Name zoneName = Name(parentZoneName).append("child-zone");
+  m_tool.createZone(zoneName, parentZoneName);
+
+  Name label("/label");
+  uint64_t version = 110;
+
+  m_tool.addRrSet(zoneName, label, label::NS_RR_TYPE, NDNS_RESP, version);
+  // throw error when adding duplicated rrset with the same version
+  BOOST_CHECK_THROW(m_tool.addRrSet(zoneName, label, label::NS_RR_TYPE, NDNS_RESP, version),
+                    ndns::ManagementTool::Error);
+  version--;
+  // throw error when adding duplicated rrset with older version
+  BOOST_CHECK_THROW(m_tool.addRrSet(zoneName, label, label::NS_RR_TYPE, NDNS_RESP, version),
+                    ndns::ManagementTool::Error);
+
+  version++;
+  version++;
+  BOOST_CHECK_NO_THROW(m_tool.addRrSet(zoneName, label, label::NS_RR_TYPE, NDNS_RESP, version));
+
+  Zone zone(zoneName);
+  m_dbMgr.find(zone);
+  Rrset rrset;
+  rrset.setZone(&zone);
+  rrset.setLabel(label);
+  rrset.setType(label::NS_RR_TYPE);
+  m_dbMgr.find(rrset);
+
+  BOOST_CHECK_EQUAL(rrset.getVersion(), name::Component::fromVersion(version));
+}
+
 BOOST_FIXTURE_TEST_CASE(ListAllZones, ManagementToolFixture)
 {
   m_tool.createZone(ROOT_ZONE, ROOT_ZONE, time::seconds(1), time::days(1), rootKsk, rootDsk);