Frequently Asked Questions

The judgement of Zonemaster is primarily based on the DNS standards as defined in RFCs. It also bases its judgement on DNS best practices, which can be more loosely defined.

All Zonemaster tests are defined in the Test Case Specification documents in which the references to the standard documents for each test case are found.

The descriptions of message levels such as NOTICE, WARNING and ERROR are found in Severity Level Definitions.

Sometimes there are different interpretations of the standards or opinions on what is best practice, and the Zonemaster team is always open to input. If you think we have made a mistake in our judgement please do not hesitate to send us an email at zonemaster-users@lists.iis.se (moderated mailing list) with a link to your test result and an explanation as to why you think it shows something that you consider incorrect.

• Zonemaster saves all history from earlier tests based on the tested domain name, which means you can go back to a test you did some time ago and compare it to the test you ran just a moment ago.
• All tests that Zonemaster runs are defined in the Test Case Specification documents that can be found in the Test Case Specification documents.
• Zonemaster can be used to test undelegated domain names.
• Zonemaster can be used to test DS records before their publication in the parent zone.
• This open source version of Zonemaster was built using modular code which basically means that you can integrate parts of it in your own systems, if you wish. For example, it is quite rare that you would want a complete program just to check for redelegations.

The Zonemaster tool could help different kind of users:

• DNS administrators, experts and beginners alike, who want to check their DNS configuration;
• users who want to know whether the domain name they own or use have any issues or not.

Users of the second category should contact their DNS operator in case there are errors or warnings for any test of their domain name.

Nothing besides the test domain, other test parameters and the result is stored in the database. Specifically we do not store any information that could link a test to the user who initiated it.

However, since zonemaster.net, like other public instances, is open to everyone, it is possible for anyone to test your domain and view its history of tests

Zonemaster sends multiple DNS queries to the name servers hosting the domain name being tested and also to the name servers hosting the parent zone of that domain name.

The web interface of Zonemaster does not show the queries that were sent, only the CLI interface can. If you want to see such queries, you will have to locally install a minimally working Zonemaster instance with both the Engine and CLI components. See the CLI installation document for more information, or if you prefer a Docker image is also available.

Queries sent can be shown using the ‘DEBUG’ level option. Fair warning, the output from the CLI can be quite heavy. For more information see CLI usage documentation.

Zonemaster is a software package that validates the quality of a DNS delegation.

The ambition of the Zonemaster project is to develop and maintain an open source DNS validation tool, offering improved performance over existing tools and providing extensive documentation which could be re-used by similar projects in the future.

Zonemaster consists of several modules or components:

• Engine, a test framework that supports all functionality to perform DNS tests;
• CLI, a command-line interface to the Engine;
• Backend, a server that allows you to run Zonemaster tests and save results using a JSON-RPC API and a database;
• GUI, a web interface to the Backend.

The components will help different types of users to check a domain’s name servers for configuration errors and generate a report that will assist in fixing the errors.

Zonemaster is a joint project between AFNIC, the registry of “.fr” TLD and several other TLDs like “.re”, “.pm”, “.tf”, “.wf”, “.yt” and “.paris”, and The Swedish Internet Foundation, the registry of “.se” and “.nu” TLDs.

Yes. If DNSSEC is available for a domain name that is tested by Zonemaster, it will be checked automatically.

Yes. Use the “Show options” button and there add the Delegation Signer (DS) records to be tested. Zonemaster will then use those in the same way as if they were already added in the parent zone.

It depends on which test failed for your domain name. Each test is accompanied with one or several messages describing the issues found.

You can also get further insight about each test from the Test Case Specification documents.

There are several possibilities.

• Your domain name is not yet delegated.
• Your domain name is not reachable from public Internet.
• Zonemaster can only test what is called a DNS zone, for example ‘zonemaster.net’, and not host names, like ‘www.zonemaster.net’.
• There is a 10 minutes protection between consecutive tests for a given domain name, with same test parameters. Running a test within that window will instead show the last available test for that domain name, and parameters.
• You have misspelled your domain name.

Yes. By default Zonemaster will query name servers both over IPv4 and IPv6, unless explicitly configured otherwise. Such configuration is accessible through the “Show options” button.

Info

The message is something that may be of interest to the zone’s administrator but that definitely does not indicate a problem.

Notice

The message means something that should be known by the zone’s administrator but that need not necessarily be a problem at all.

Warning

The message means something that will under some circumstances be a problem, but that is unlikely to be noticed by a casual user.

Error

The message means a problem that is very likely (or possibly certain) to negatively affect the function of the zone being tested, but not so severe that the entire zone becomes unresolvable.

Critical

The message means a very serious error.

To check a reverse zone with Zonemaster, one first needs to know what the reverse zone is, and enter it in the format it has in the DNS. A reserve zone is obtained by reversing an IP address and adding a suffix. IPv4 addresses use the suffix “in-addr.arpa” while IPv6 addresses use “ip6.arpa”.

Examples:

• for IPv4 prefix “198.51.100.0/24”: 100.51.198.in-addr.arpa
• for IPv6 prefix “2001:db8::/32”: 8.b.d.0.1.0.0.2.ip6.arpa

All test cases belong to one specific test level and their names are based on that test level’s name. The following test levels are defined and available:

• Address
• Basic
• Connectivity
• Consistency
• DNSSEC
• Delegation
• Nameserver
• Syntax
• Zone

The test level name is not case-sensitive, but the forms defined above must be used when referring to the test levels, i.e. only the first letter uppercase, expect for acronyms for which all uppercase is used. For example “Address” and neither “ADDRESS” nor “address”.

The test case identifier in the test case specification (both in the main headline and in the “Test case identifier” section) uses the test level name, as defined above, and has the format: {Test level name} + {Index}

When referencing to a test case, for readability, the letter case defined above must be used for the test level name.

The {Index} is a two-digit suffix 01-99, and should be selected so that the test case identifier is unique. Normally the first free index is selected.

Example of test case identifiers:

• Address03
• Basic04
• DNSSEC15
• Zone06

An undelegated domain test is a test performed on a domain name that may, or may not, be fully published in the DNS.

This can be quite useful if one is going to migrate one’s domain from one registrar to another, for example, migrate zone ‘example.com’ from the name server ‘ns.example.com’ to the name server ‘ns.example.org’. In this scenario one could perform an undelegated domain test providing the zone (‘example.com’) and the name server you are migrating to (‘ns.example.org’) before you migrate your domain.

When the results of the test doesn’t show any errors or warnings one can be fairly certain that the domain’s new location is working well. However there might still be other problems in the zone data itself that this test is unaware of.