netbirdio/netbird · error

invalid zone domain format

Error message

invalid zone domain format

What it means

Zone.Validate() requires Domain to pass domain.IsValidDomainNoWildcard: an ASCII (or punycode) domain with no "*." prefix, no trailing dot, labels of 1-63 chars starting/ending alphanumeric. The empty string also fails. Zones deliberately reject wildcards even though DNS record names inside a zone may carry them.

Source

Thrown at management/internals/modules/zones/zone.go:77

	z.DistributionGroups = req.DistributionGroups

	enabled := true
	if req.Enabled != nil {
		enabled = *req.Enabled
	}
	z.Enabled = enabled
}

func (z *Zone) Validate() error {
	if z.Name == "" {
		return errors.New("zone name is required")
	}
	if len(z.Name) > 255 {
		return errors.New("zone name exceeds maximum length of 255 characters")
	}

	if !domain.IsValidDomainNoWildcard(z.Domain) {
		return errors.New("invalid zone domain format")
	}

	if len(z.DistributionGroups) == 0 {
		return errors.New("at least one distribution group is required")
	}

	return nil
}

func (z *Zone) EventMeta() map[string]any {
	return map[string]any{"name": z.Name, "domain": z.Domain}
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Use an explicit domain without the wildcard prefix, e.g. "corp.example.com".
2. Strip trailing dots and punycode-convert unicode before submitting.
3. For wildcard coverage, create the zone on the base domain and put "*." on individual record names instead.

Example fix

// before
{"name": "Corp", "domain": "*.corp.example.com", "distribution_groups": ["grp-1"]}
// after
{"name": "Corp", "domain": "corp.example.com", "distribution_groups": ["grp-1"]}

if !domain.IsValidDomainNoWildcard(strings.TrimSuffix(req.Domain, ".")) {
    return fmt.Errorf("zone domain %q must be a plain domain without wildcard", req.Domain)
}

func isValidZoneDomain(d string) bool {
    return domain.IsValidDomainNoWildcard(strings.TrimSuffix(d, "."))
}

if err := zone.Validate(); err != nil {
    return respondBadRequest(err)
}

When it happens

Trigger: Zone create/update with domain "*.corp.example.com", "corp.example.com." (trailing dot), "café.example.com" (unicode), "" (empty), or a label over 63 chars.

Common situations: Expecting wildcard zone support like name-based network resources have; FQDN strings normalized with a trailing dot upstream; unicode domains not punycode-encoded; confusing the zone domain with the zone display name.

Related errors

• invalid record name format
• record name is required
• record type is required
• invalid CNAME target format
• invalid record type, must be A, AAAA, or CNAME

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/7c0658bca64c3e93. Report an issue: GitHub.