{"record":{"id":"7c0658bca64c3e93","repo":"netbirdio/netbird","slug":"invalid-zone-domain-format","errorCode":null,"errorMessage":"invalid zone domain format","messagePattern":"invalid zone domain format","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"error","filePath":"management/internals/modules/zones/zone.go","lineNumber":77,"sourceCode":"\tz.DistributionGroups = req.DistributionGroups\n\n\tenabled := true\n\tif req.Enabled != nil {\n\t\tenabled = *req.Enabled\n\t}\n\tz.Enabled = enabled\n}\n\nfunc (z *Zone) Validate() error {\n\tif z.Name == \"\" {\n\t\treturn errors.New(\"zone name is required\")\n\t}\n\tif len(z.Name) > 255 {\n\t\treturn errors.New(\"zone name exceeds maximum length of 255 characters\")\n\t}\n\n\tif !domain.IsValidDomainNoWildcard(z.Domain) {\n\t\treturn errors.New(\"invalid zone domain format\")\n\t}\n\n\tif len(z.DistributionGroups) == 0 {\n\t\treturn errors.New(\"at least one distribution group is required\")\n\t}\n\n\treturn nil\n}\n\nfunc (z *Zone) EventMeta() map[string]any {\n\treturn map[string]any{\"name\": z.Name, \"domain\": z.Domain}\n}\n","sourceCodeStart":59,"sourceCodeEnd":90,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/management/internals/modules/zones/zone.go#L59-L90","documentation":"Zone.Validate() requires Domain to pass domain.IsValidDomainNoWildcard: an ASCII (or punycode) domain with no \"*.\" prefix, no trailing dot, labels of 1-63 chars starting/ending alphanumeric. The empty string also fails. Zones deliberately reject wildcards even though DNS record names inside a zone may carry them.","triggerScenarios":"Zone create/update with domain \"*.corp.example.com\", \"corp.example.com.\" (trailing dot), \"café.example.com\" (unicode), \"\" (empty), or a label over 63 chars.","commonSituations":"Expecting wildcard zone support like name-based network resources have; FQDN strings normalized with a trailing dot upstream; unicode domains not punycode-encoded; confusing the zone domain with the zone display name.","solutions":["Use an explicit domain without the wildcard prefix, e.g. \"corp.example.com\".","Strip trailing dots and punycode-convert unicode before submitting.","For wildcard coverage, create the zone on the base domain and put \"*.\" on individual record names instead."],"exampleFix":"// before\n{\"name\": \"Corp\", \"domain\": \"*.corp.example.com\", \"distribution_groups\": [\"grp-1\"]}\n// after\n{\"name\": \"Corp\", \"domain\": \"corp.example.com\", \"distribution_groups\": [\"grp-1\"]}","handlingStrategy":"validation","validationCode":"if !domain.IsValidDomainNoWildcard(strings.TrimSuffix(req.Domain, \".\")) {\n    return fmt.Errorf(\"zone domain %q must be a plain domain without wildcard\", req.Domain)\n}","typeGuard":"func isValidZoneDomain(d string) bool {\n    return domain.IsValidDomainNoWildcard(strings.TrimSuffix(d, \".\"))\n}","tryCatchPattern":"if err := zone.Validate(); err != nil {\n    return respondBadRequest(err)\n}","preventionTips":["Never send \"*.\" domains for zones; put wildcards on record names inside the zone instead.","Punycode-convert unicode zone domains client-side before submission."],"tags":["dns","zones","validation","punycode"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}