DNS Zone File Validator

About the DNS Zone File Validator

A zone file holds every DNS record of a domain in the text format that RFC 1035 defines and BIND uses: $ORIGIN and $TTL lines, names relative to the origin, a multi-line SOA record in parentheses, quoted TXT strings. One missing dot or a CNAME next to another record breaks part of a domain without any warning, and RFC 1035 §5.2 asks name servers not to load a file that has an error in it at all.

Paste the file or open it, and the validator reads it the way an authoritative server does: it reports syntax errors with their line, then checks the zone as a whole against the standards — a CNAME with other records or at the top of the zone, MX, NS and SRV targets that are aliases or have no address, missing trailing dots that turn mail.example.com into mail.example.com.example.com., TXT strings over 255 octets, two SPF records, SOA timers outside the ranges RFC 1912 and RFC 2308 recommend, delegations without glue, records outside the zone, and more. Everything runs in your browser: the file is never uploaded, and the page keeps working offline once it has loaded.

Without a pass, the free preview shows the record and problem counts in full, with the first problems found and the first lines of the normalised zone; copying and the .zone, JSON and CSV downloads unlock with a Pro pass.

Common uses

• Checking a zone file before loading it into BIND or another name server, or before importing it at a DNS host.
• Reviewing a zone exported from one DNS host before moving the domain to another.
• Finding why mail, a subdomain or a certificate check fails: an alias where a host name is needed, a missing dot, a second SPF record.
• Turning a zone file into JSON or CSV for a script, a spreadsheet or a DNS host’s API.

What is checked

• Syntax (RFC 1035 §5): entries and parentheses, comments, quoted strings and the \X and \DDD escapes, @, names relative to the origin, TTL and class in either order, and the generic TYPEnnn / \# length hex form of RFC 3597. Each record’s data is checked field by field for the common types (A, AAAA, NS, CNAME, SOA, MX, TXT, SRV, CAA, DS, DNSKEY, TLSA, SSHFP, HTTPS, SVCB and more); other types are kept as written.
• Names: labels of 1 to 63 octets and names of at most 255 (RFC 2181 §11); a * only as the leftmost label (RFC 4592 §2.1.1); host names of letters, digits and hyphens for address records (RFC 1123 §2.1).
• Aliases: a name with a CNAME holds no other data, so never at the top of a zone (RFC 1034 §3.6.2, RFC 2181 §10.1); NS and MX records never point to an alias (RFC 2181 §10.3), nor do SRV records (RFC 2782); DNAME rules of RFC 6672 §2.3–2.4.
• TTLs: 0 to 2147483647 seconds (RFC 2181 §8), and the same TTL for all records of one name and type (RFC 2181 §5.2).
• The zone: one SOA record at the top (RFC 1035 §5.2), at least two name servers (RFC 1912 §2.8), glue for name servers inside a delegated child (RFC 1912 §2.3), nothing below a delegation but glue, nothing outside the zone, one class.
• Strings and mail: every quoted string at most 255 octets (RFC 1035 §3.3); SPF only as TXT and once per name (RFC 7208 §3); a “null MX” alone (RFC 7505 §3); CAA flags, tags and values (RFC 8659).

Relative names and the trailing dot

A name that ends with a dot is absolute and is used exactly as written. A name without the final dot is relative: the current origin is added to it. In a zone for example.com., www means www.example.com., @ means example.com. itself — and mail.example.com (no dot) means mail.example.com.example.com.. RFC 1912 §3.2 puts it plainly: “Double check, triple check, those trailing dots”. The validator warns when a relative name repeats the zone’s name or ends in a common top-level domain, which is almost always a missing dot.

The origin is the zone’s domain you enter, otherwise the first $ORIGIN line, otherwise the SOA record’s name (written in full), as a name server takes it from the zone it loads the file for. A $ORIGIN line changes it for the lines below it.

SOA timers

The SOA record’s four timers tell secondary servers how to keep their copy, and its last field how long resolvers remember a “no such name” answer:

• Refresh: how often a secondary checks the serial. RFC 1912 §2.2 suggests 20 minutes to 2 hours, or 2 to 12 hours on slow links; with NOTIFY a day or more is fine.
• Retry: the wait after a failed refresh, “typically some fraction of the refresh interval”.
• Expire: how long a secondary keeps answering without reaching the primary; it must be longer than refresh and retry, and 2 to 4 weeks are suggested.
• Minimum (last field): since RFC 2308 this is the negative-caching TTL. One to three hours works well; values over a day have been found problematic (§5).
• Serial: a 32-bit number to increase with every change; YYYYMMDDnn is the recommended form.

BIND extensions

BIND 9 reads some lines that are not part of the standard format, and this validator reads them too, with a note: $GENERATE start-stop[/step] owner [ttl] [class] type rdata makes a series of records ($ is the counter; ${offset,width,base} with the bases d, o, x and X is supported, the nibble bases n and N are not), and TTLs may be written with units such as 1h30m or 2d. Other servers and DNS hosts may not read either, so the normalised zone writes plain records and seconds. $INCLUDE reads another file, which a web page cannot open: paste that file’s records too. The syntax follows the BIND 9 reference manual.

The exports

• Normalised zone (.zone): $ORIGIN and $TTL lines, then one record per line with its absolute name in lower case, TTL, class and type, the SOA first and the zone’s own NS records next. Comments are dropped, strings longer than 255 octets are split, $GENERATE is expanded and key data is joined on one line. Records of the rarer types this checker keeps as written get a $ORIGIN line before them when the file gave them another origin, so names inside their data keep their meaning.
• JSON: { "origin": …, "records": [ { "name", "ttl", "class", "type", "data", "line" } ] }, for scripts and DNS hosts’ APIs; a record kept as written also has its own "origin".
• CSV: one row per record with the columns name, ttl, class, type and data, in quotes where needed; a value a spreadsheet would run as a formula gets a leading apostrophe.

Limitations

• Only the records in the file are checked: names in other zones (another domain’s name servers or mail servers) are not looked up. Use the DNS lookup to see what is published.
• $INCLUDE files cannot be opened from a web page; paste their records into the box too.
• DNSSEC records (RRSIG, NSEC, NSEC3, DNSKEY) are read and their fields checked, but signatures are not verified.
• Up to 300,000 records (8 million characters) are read in one run.

Privacy

On this device: nothing is sent

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.