Zone management
Lint and validation
Validate DNS records before push with checks for names, CNAME rules, delegation, SPF lookups, DMARC, CAA, DNSSEC, raw RDATA, TTLs, and provider support.
8 min read
On this page
The release zone checker runs 47 local, synchronous checks over the current browser draft. The key point is that Zone checks does not query DNS and its findings do not by themselves block Save changes; the record form and server still enforce their own name, TTL, size, and nonempty-value guards.
Read the Zone checks panel#
Open Zones → a zone → Records. The panel sorts errors, warnings, then notes, and starts open when the first render has an error. Selecting a record link puts that owner name in Search records. Use Preview changes separately to read provider state.
Names, targets, and record sets#
| Code | Severity and release message | What it checks |
|---|---|---|
outside-zone | Error — “owner is not inside zone.” | The canonical owner must be the apex or end in the zone name. |
invalid-label | Error — “owner is not a valid DNS name.” | Labels use letters, digits, _, and -; * is allowed only as the first complete label. |
label-underscore | Warning — “Label label contains _ (can't be used in a URL).” | Ordinary owner labels with underscores. SRV, TLSA, TXT, LUA, leading/service underscores, and sql- names are exempt. |
label-stutter | Error — “owner repeats the domain name. Did you forget a trailing dot?” | A non-reverse owner ends in the zone twice. |
duplicate-value | Error — “Exact duplicate type value at owner.” | The same canonical value appears twice in one source record set. |
invalid-address | Error — “value is not a valid IPv4/IPv6 address.” | A and AAAA values. |
invalid-target | Error — the target is empty or includes a forbidden character. | CNAME, MX, NS, SRV, PTR, ALIAS, and DNAME targets. |
target-is-ip | Error — “type target target must be a hostname, not an IP address.” | A host-target field contains an IPv4 or IPv6 literal. |
target-stutter | Warning — “Target target repeats the domain name. Did you forget a trailing dot?” | A non-reverse target repeats the current zone. |
target-is-cname | Error — “type target target is a CNAME (RFC 2181 10.3).” | An in-zone non-CNAME target points at an owner whose draft type is CNAME. |
target-missing | Warning — “type target target has no records in this zone.” | An in-zone target has no exact or wildcard draft record and is not below a child delegation. PTR and DNAME are exempt. |
ttl-range | Warning — inconsistent merged TTLs, or “TTL n is outside provider's range min-max.” | Duplicate source sets use different TTLs, or a positive TTL is outside an assigned provider’s catalog range and is not that provider’s automatic-TTL value. |
Saving merges sets with the same owner, type, and routing identifier, removes duplicate canonical values, and uses the lowest TTL. The checker reports inconsistent source TTLs before that merge.
CNAMEs, delegation, and wildcards#
| Code | Severity and release message | What it checks |
|---|---|---|
cname-coexist | Error — “owner has a CNAME and types records. A CNAME must be alone at its name.” | CNAME shares an owner. A proxied CNAME when Cloudflare is assigned, AKAMAICDN, and an apex flattened by every assigned provider are exceptions in this check. |
cname-multiple | Error — “owner has n CNAME targets; only one is allowed.” | More than one CNAME value. |
cname-apex | Error — “A CNAME at the zone apex is not allowed. Use ALIAS or A/AAAA records.”; note when every assigned provider advertises flattening. | Apex CNAME support across the assigned providers. |
cname-loop | Error — “owner is a CNAME that points at itself.” | Direct self-reference. |
ns-apex | Error — “NS records at the apex are managed with NAMESERVER(), not NS().” | A draft NS record at the zone apex. |
ns-count | Warning — “Only one NAMESERVER is declared; RFC 1034 requires at least two.” | The saved explicit nameserver list has exactly one entry. |
occluded | Warning — “owner type is at or below the delegation name and will not be served.” | Records below a child NS delegation. Same-name NS/DS and required in-bailiwick A/AAAA glue are exempt. |
wildcard-shadow | Note — “n name(s) under parent have their own records, so the wildcard type does not apply to them: names.” | Immediate child names shadow a wildcard and lack that type or CNAME. The message lists at most five names. |
mx-null | Note — “Null MX (RFC 7505): this domain does not accept mail.” | An MX value ends in the root target .. |
srv-name | Error — “SRV name label must look like _service._proto.” | The first two owner labels do not start with _. |
srv-protocol | Warning — expected _tcp, _udp, _tls or _sctp. | The second SRV label is unusual. |
TXT, SPF, and DMARC#
| Code | Severity and release message | What it checks |
|---|---|---|
txt-too-long | Error — “TXT value is n bytes; provider allows max.” | A TXT value longer than an assigned provider’s logical-value limit. The release implementation uses JavaScript string length even though the message says bytes. |
txt-chunked | Note — “TXT value is n bytes and will be sent as several 255-byte strings.” | A TXT value longer than 255 characters when no assigned provider limit is exceeded. |
spf-multiple | Error — “owner has n SPF records; receivers return permerror.” | More than one TXT value beginning with v=spf1. |
spf-type | Warning — “The SPF record type is obsolete (RFC 7208). Use a TXT record.” | Any canonical SPF record. |
spf-lookups | Error — “SPF needs at least n DNS lookups; the limit is 10.” | Direct include, a, mx, ptr, exists, and redirect= terms exceed ten. |
spf-syntax | Error — parser-specific message. | A detected SPF policy has a missing version, malformed term, unknown mechanism, invalid mechanism argument/CIDR, repeated redirect= or exp=, or invalid redirect domain. |
spf-warning | Warning — parser-specific message. | Terms after all, permissive all, deprecated ptr, ignored redirect, no all or redirect, or a policy over 450 characters. |
dmarc-location | Warning — “A DMARC record must be at _dmarc, not label.” | A TXT value beginning with v=DMARC1 is stored elsewhere. |
dmarc-multiple | Error — “owner has n DMARC records.” | More than one v=DMARC1 value at _dmarc or _dmarc.*. |
dmarc-syntax | Error — parser-specific message. | DMARC tag syntax and supported value rules. |
dmarc-warning | Warning — parser-specific message. | Unknown tags, a rua-only policy without p, deprecated tags, and p=none. |
SPF checking starts automatically for TXT values that already begin with v=spf1; an unrelated or misspelled TXT version is not treated as SPF. Unknown SPF modifiers in name=value form are retained without a finding unless they are the specially checked redirect or exp modifiers.
DMARC analysis at _dmarc checks values beginning with v=. It requires the first tag to be v=DMARC1, rejects duplicate tags, validates p, sp, np, adkim, aspf, pct, ri, fo, psd, t, rua, and ruf, and warns for unknown tags, deprecated pct/rf/ri, missing p when rua exists, and monitoring-only p=none.
CAA and DNSSEC records#
| Code | Severity and release message | What it checks |
|---|---|---|
caa-value | Error — value is not flag tag "value", an issue/issuewild value is not a CA domain or ;, or iodef is not mailto: or HTTP(S). | Canonical CAA shape and selected tag values. |
caa-flag | Warning for unusual values through 255; error above 255 — “CAA flag n should be 0 or 128.” | CAA flags. |
caa-tag | Error — “CAA tag tag is invalid.” | issue, issuewild, iodef, contactemail, contactphone, issuemail, or issuevmc. |
ds-apex | Warning — “DS records for the zone itself belong in the parent zone (the registrar).” | DS at the managed-zone apex. |
ds-without-ns | Error — “DS at owner needs an NS delegation at the same name.” | Child DS without same-owner NS. |
ds-syntax | Error or warning with a field-specific message. | Key tag, known/deprecated algorithm, digest type 1/2/4, hexadecimal length, and deprecated SHA-1 digest type 1. |
dnskey-managed | Note — “DNSKEY records are usually created by the provider when DNSSEC is enabled.” | Every DNSKEY record. |
dnskey-syntax | Warning or error with a field-specific message. | Flags 256/257, protocol 3, known algorithm, and base64-shaped public key. |
soa-not-apex | Error — “SOA is only valid at the zone apex.” | SOA below the apex. |
soa-multiple | Error — “A zone can only have one SOA record.” | More than one SOA value in the merged apex set. |
Raw RDATA fields#
The release checker does not locally parse CERT, DHCID, HTTPS, LOC, NAPTR, OPENPGPKEY, RP, SMIMEA, SSHFP, SVCB, TLSA, URI, or provider-specific pseudo-record RDATA. The raw Record data field requires only a nonempty value before save.
Some dnsconfig.js constructors separately enforce argument counts, integer ranges, or a small set of enum values while importing. That constructor validation is not a general zone checker and does not run on a raw value typed directly into the editor. Use the zone file validator for BIND syntax and validate advanced RDATA with the system that issued it.
Provider-aware checks#
| Code | Severity and release message | What it checks |
|---|---|---|
type-unsupported | Error — the provider does not support the type, alias, TXT length, or routing policy. | unsupportedReason() against every assigned provider. Apex CNAME gets cname-apex instead. |
proxy-unsupported | Warning — “provider has no proxy; owner will be served unproxied.” | Proxy metadata assigned to a provider whose catalog has no proxy feature. |
autodnssec-unsupported | Warning — “AUTODNSSEC_ON is set but provider can't manage DNSSEC automatically.” | DNSSEC is set to Sign for a provider without automatic DNSSEC. |
The checker warns when a TTL is outside a provider’s catalog range unless it equals that provider’s automatic-TTL value. The release managed-zone planner does not clamp other values before building the provider plan. Choose a TTL every destination accepts, then inspect the provider result after pushing.
A clean panel means only that these release checks found no issue. It does not prove that raw advanced RDATA is valid, that provider credentials can write, or that live DNS matches. Continue with Preview and push and DNSControl parity.