Zone Validation

Automatic syntax, semantic, and best-practice checks on every zone transfer and upload.

Overview

Every time a zone is transferred or uploaded, hiddenprimary.ch parses the zone content and runs a series of checks. Issues are classified by severity — errors, warnings, and informational notes — so you can prioritise fixes.

Check Levels

The depth of validation depends on your plan:

Plans	Check Level	Checks Included
Professional	Syntax	Parse errors, missing SOA, missing apex NS, plus the delegation check
Business, Max	Full	Syntax + semantic + best practice — the complete table below

Full validation is tied to the zone_validation plan feature, not to whether a plan is paid; the rows above are read from the live plan configuration.

The free trial runs at the level of the plan you chose when you registered: the Business trial gets the full check from its first transfer.

All Validation Codes

Every code the validator can emit. This table is generated from the checks themselves, so it cannot drift out of sync with what you see in the portal.

Code	Severity	Description
`PARSE_ERROR`	error	Zone file cannot be parsed (invalid syntax)
`TOO_MANY_RECORDS`	error	Zone exceeds the record limit the validator will materialise
`MISSING_SOA`	error	No SOA record found in zone
`MISSING_NS`	error	No NS records found at zone apex
`ORIGIN_MISMATCH`	error	The SOA owner does not match the zone name (an $ORIGIN in the file relabels the records)
`NS_MISSING_OURS`	warning	Zone apex lists none of our nameservers — resolvers prefer the zone's own NS records over your registrar delegation, so queries will not reach us; register your own hostnames under Nameservers if they point at us
`NS_INCOMPLETE_OURS`	warning	Zone apex lists only some of our nameservers; the missing ones receive no queries
`CNAME_AT_APEX`	error	CNAME record at zone apex (RFC 1034 violation)
`CNAME_CONFLICT`	error	CNAME coexists with other record types at the same name
`MULTIPLE_CNAME`	error	More than one CNAME at the same name
`MX_IS_CNAME`	warning	MX target owns a CNAME (RFC 2181)
`MX_IS_IP`	warning	MX target is an IP address instead of a hostname
`NS_IS_CNAME`	warning	NS target owns a CNAME
`NS_IS_IP`	warning	NS target is an IP address instead of a hostname
`NS_NO_GLUE`	warning	In-zone NS record has no matching A/AAAA glue record
`MISSING_SPF`	info	No SPF (TXT) record at the zone apex — helps prevent email spoofing
`MISSING_DMARC`	info	No DMARC record at _dmarc.<zone>
`MX_SINGLE`	info	Only one MX record at the apex — no fallback if it is unreachable
`TTL_TOO_LOW`	info	TTL below the recommended minimum
`TTL_TOO_HIGH`	info	TTL above the recommended maximum

Viewing Results

Validation results are shown in the portal on each zone's Records tab. Each issue displays the severity, code, affected record, and a description.

You can also retrieve results via the API:

terminal

$ curl https://hiddenprimary.ch/v1/zones/1/validation \

-H "Authorization: Bearer $HP_KEY"

{

"valid": false,

"issues": [

{ "severity": "error", "code": "CNAME_AT_APEX", ... }

"checked_at": "2026-03-24T10:00:00Z"

}

Webhook Notifications

Subscribe to validation events via webhooks to get notified when zone health changes:

Event	Fires When
`validation_failed`	Zone has errors (e.g. CNAME at apex, missing SOA)
`validation_warning`	Zone has warnings but no errors
`validation_ok`	Previously failing zone now passes all checks

Events only fire when the validation status changes — repeated transfers with identical content do not trigger duplicates.

Next Steps

Webhooks — subscribe to validation events
Getting Started — set up your first zone
API Reference — full validation endpoint documentation