DNS
Zone file checker
Paste a BIND-style zone file, or point this at a live domain, to catch a CNAME sharing a name it should not and an SOA whose timers are ordered wrong.
Free, no accountLive check
Result
Fill in the form and press Check the zone file. The verdict and the detail appear here.
What this is
This zone file checker reads a pasted BIND-style zone - or, in its other mode, asks a resolver what a domain is actually serving - and looks for the two structural mistakes a zone file can make that a syntax check alone will not catch.
A zone file is the plain-text source a nameserver loads a zone from: one line per resource record, usually an owner name, an optional TTL and class, a record type, and that type’s own value. Most of what can go wrong in one is a typo a nameserver simply refuses to load - this tool is after the kind of mistake that loads fine and only breaks later.
RFC 1034 §3.6.2 draws a hard line around one name carrying a CNAME record: nothing else may sit at that same name, not even an NS or an MX record that would otherwise be ordinary. A resolver asked for the other type at that name has no single correct answer, which is a worse outcome than a record simply being missing.
How to read the result
Paste mode walks the text line by line, merges an SOA record that spans several lines inside parentheses back into one, and groups every record by the owner name it belongs to so a CNAME sharing that name with anything else stands out immediately, with the exact line to go fix.
Live mode skips the parsing step entirely and asks a resolver the same question for each record type in turn, then runs the identical two checks against what actually comes back. A pasted file can describe a zone nobody ever loaded; a live answer cannot - it is what is being served at this moment, which is the only thing either mode can call proven.
Common mistakes
What goes wrong most often, and how to tell.
- Trusting a saved zone file over what is actually being servedA text file on a laptop or in a repository is a record of intent, not of fact - it can be stale, half-applied, or simply never loaded onto the nameserver that answers for the domain. Live mode exists for exactly this gap: it checks the zone as a resolver sees it right now, not the copy sitting on disk.
- Assuming a CNAME conflict will fail loudlyMost DNS hosts refuse to save a CNAME next to another record at the same name, but not every one enforces it, and a hand-built zone file loaded straight onto a nameserver can skip that guardrail entirely. The result is not a load error; it is a name that answers inconsistently depending on which record type is asked for and in what order.
- Reading a long refresh value as merely slow rather than brokenA refresh longer than expire is not a secondary that simply checks in less often - it is a secondary that can be scheduled to stop answering for the zone before its first check-in ever happens, which turns a timing choice into an outage with no warning attached.
Questions
What people ask about this tool.
- Because they answer different questions. Paste mode checks the shape of text you already have, which is useful before it ever reaches a nameserver; live mode checks what a resolver actually returns for a domain right now, which is the only way to know the pasted copy and the running zone have not drifted apart.
- RFC 1034 §3.6.2 defines a CNAME as the only record a name may carry once it carries one at all, so a resolver that sees both a CNAME and, say, an MX record at the same name has no rule telling it which to prefer. Different resolvers, or the same resolver on different days, can answer differently for the identical name.
- Usually by editing one timer without checking the other against it - raising refresh to cut down on routine traffic between primary and secondary, without noticing that expire, the point a secondary must stop answering entirely, is now shorter than the interval meant to keep it caught up in the first place.
- A fragment works for the CNAME check, since that only needs the records at the name in question. The SOA timer check needs the apex’s own SOA line somewhere in the paste - leave it out and this tool says plainly that no SOA was found, rather than guessing at timers it never saw.
Sources
Every fixed value here comes from the provider’s own documentation. These pages change, so each says the day it was last read.
- IETF, “RFC 1034: Domain Names - Concepts and Facilities” read 13 October 2026
- IETF, “RFC 1035: Domain Names - Implementation and Specification” read 13 October 2026
- IETF, “RFC 1912: Common DNS Operational and Configuration Errors” read 13 October 2026
Use it from the API
The same check, as one request.