Zone file checker

Reads a zone file of up to 64 KiB in master file format (RFC 1035) with $ORIGIN and $TTL, and reports lines that cannot be read, a missing or misplaced SOA, missing NS, CNAME at the apex or beside other data, duplicates, mixed TTLs in a set, odd TTLs, out-of-zone names, targets without addresses and SOA values. Nothing is looked up.

Updated 2026-10-27

What this tool checks

The file is read line by line as a zone loader reads it, with the zone name you give as the origin:

Syntax: unknown types, record data that does not fit its type, invalid names and unclosed quotes or parentheses, each as ZONE_SYNTAX_ERROR with the line number.
Apex: exactly one SOA at the zone name and NS records there, with a warning for a single name server.
CNAME rules: no CNAME at the apex, none beside other data, one per name, and no NS, MX or SRV target that is a CNAME.
Records: duplicates, different TTLs in one record set, TTLs out of range (a Cloudflare export writes TTL 1 for Auto, which is reported as unusual only), names outside the zone, and in-zone targets without A or AAAA records.
SOA timers: serial format, refresh, retry, expire and the negative caching TTL against RFC 1912 and RFC 2308.

How to read the result

Errors are what a zone loader refuses. Warnings are what loads but behaves differently from what the author meant. The result also counts records per type and shows the SOA values.

Limitations

DNSSEC signatures are not verified, and record types other than the common ones are kept as text without checking their data.
The zone is not compared with what its name servers publish.

Use it from code

API reference for Zone file checker

curl -i -X POST https://api.lookproof.dev/v1/dns/zone-lint \
  -H 'content-type: application/json' \
  -d '{"origin": "example.com", "zone": "$TTL 3600\n@       IN SOA  ns1.example.com. hostmaster.example.com. (\n                2026102701 ; serial\n                7200       ; refresh\n                3600       ; retry\n                1209600    ; expire\n                3600 )     ; minimum\n        IN NS   ns1\n        IN NS   ns2.example.net.\n        IN MX   10 mail\n        IN A    192.0.2.10\nns1     IN A    192.0.2.53\nmail    IN A    192.0.2.25\nwww     IN CNAME @\nwww     IN TXT  \"site-verification=abc123\"\n"}'

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Zone file, Zone name
Deadline	2 seconds
Freshness	Computed from the input; nothing is looked up
Price	$0.002 per check

Findings this tool can report

Name servers (1)

Warning NS_SINGLE The zone has only one name server.

SOA record (6)

Warning SOA_EXPIRE_BELOW_REFRESH The SOA expire is not longer than refresh plus retry.
Info SOA_EXPIRE_SHORT The SOA expire is shorter than two weeks.
Info SOA_NEGATIVE_TTL_LONG The SOA minimum (negative caching TTL) is longer than three hours.
Info SOA_REFRESH_OUT_OF_RANGE The SOA refresh is outside 20 minutes to 12 hours.
Warning SOA_RETRY_NOT_BELOW_REFRESH The SOA retry is not shorter than the refresh.
Info SOA_SERIAL_NOT_DATE The SOA serial is not in the YYYYMMDDnn date form.

Zone files (17)

Error ZONE_CNAME_AT_APEX The zone apex has a CNAME record.
Error ZONE_CNAME_WITH_OTHER_DATA A name has a CNAME and other records at the same time.
Warning ZONE_DIRECTIVE_IGNORED The zone file uses $INCLUDE or $GENERATE, which were not read.
Warning ZONE_DUPLICATE_RECORD The same record appears more than once in the zone.
Error ZONE_MULTIPLE_CNAME A name has more than one CNAME record.
Error ZONE_MULTIPLE_SOA The zone has more than one SOA record.
Warning ZONE_NO_DEFAULT_TTL Records without a TTL appear before any $TTL line.
Error ZONE_NO_NS The zone has no NS records at its apex.
Error ZONE_NO_SOA The zone has no SOA record.
Warning ZONE_OUT_OF_ZONE A record's name lies outside the zone.
Error ZONE_SOA_NOT_AT_APEX The SOA record is not at the zone's name.
Error ZONE_SYNTAX_ERROR A line of the zone file cannot be read.
Warning ZONE_TARGET_IS_CNAME An NS, MX or SRV record points to a name that is a CNAME.
Warning ZONE_TARGET_NO_ADDRESS An NS, MX or SRV target inside the zone has no address record.
Warning ZONE_TTL_MISMATCH Records of one name and type have different TTLs.
Error ZONE_TTL_OUT_OF_RANGE A TTL is larger than DNS allows.
Info ZONE_TTL_UNUSUAL A TTL is below one minute or above one week.

Frequently asked questions

Which zone file format does the tool read?

The master file format of RFC 1035 that BIND, Knot, NSD and PowerDNS use: $ORIGIN, $TTL, @, relative names, blank owners that repeat the previous name, parentheses across lines, comments and quoted strings. $INCLUDE and $GENERATE are reported and skipped: ZONE_DIRECTIVE_IGNORED.

Why is a CNAME next to a TXT record an error?

A name with a CNAME may hold no other data except DNSSEC records (RFC 1034 section 3.6.2). Resolvers then give inconsistent answers, and most zone loaders refuse the zone: ZONE_CNAME_WITH_OTHER_DATA. The same rule forbids a CNAME at the zone apex.

How large can the zone be?

Up to 65,536 characters, here and through the API. A longer file gets a field error; nothing is cut off. Split a larger zone, or check the part you changed.

Is the zone stored or looked up?

No. It is read as text and checked in memory; nothing is resolved and nothing is kept. To see what resolvers answer for a published zone, use the DNS lookup.