Test internal only domain?

[juju4]

Is it possible? (RFC2606, RFC6762, ICANN 29-07-2024 like .test, .example, .invalid, .intranet, .internal, .private...)
scoring may need review but at least, it gets a view on best practices usage.

seems nok

$ docker run -t --rm zonemaster/cli internal --no-ipv6
Seconds Level    Message
======= ======== =======
 130.14 WARNING  The parent zone cannot be found.
 130.14 ERROR    "internal" does not exist as a DNS zone. Try to test "." instead.
 130.14 CRITICAL Not enough data about internal was found to be able to run tests.
julien@mldocker004:~$ dig internal

; <<>> DiG 9.18.39-0ubuntu0.24.04.1-Ubuntu <<>> internal
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23278
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: fec6f452c35ea7c60100000068c732a8fe5376006c0a13c6 (good)
;; QUESTION SECTION:
;internal.			IN	A

;; ANSWER SECTION:
internal.		86400	IN	A	10.x.y.z

;; Query time: 27 msec
;; SERVER: 10.x.y.1#53(10.x.y.1) (UDP)
;; WHEN: Sun Sep 14 21:24:53 UTC 2025
;; MSG SIZE  rcvd: 89

Thanks

[matsduf]

TLD .internal is not delegated from the root zone. It seems like your resolver is hosting a .internal zone. Zonemaster starts by querying the root zone to find the path to the zone to be tested.

Query to a root name server, and note NXDOMAIN in the response:

$ dig @k.root-servers.net internal +mult

; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> @k.root-servers.net internal +mult
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 57300
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;internal.		IN A

;; AUTHORITY SECTION:
.			86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. (
				2025091500 ; serial
				1800       ; refresh (30 minutes)
				900        ; retry (15 minutes)
				604800     ; expire (1 week)
				86400      ; minimum (1 day)
				)

;; Query time: 22 msec
;; SERVER: 2001:7fd::1#53(k.root-servers.net) (UDP)
;; WHEN: Mon Sep 15 07:34:56 UTC 2025
;; MSG SIZE  rcvd: 112

[matsduf]

If you want to test your internal .internal you have to have an internal root name server that delegates that to the locally authoritative servers. The question is, why do you want to test the .internal zone?

[juju4]

as said, it's mostly best practices checks, be it redundancy, security, configuration and so on.
Any option to ignore root level check and just check domain zone and below?

[marc-vanderwal]

You could try performing an undelegated test. Just pass the names and IP addresses of the authoritative name servers for your .internal domain using --ns options, like so:

zonemaster-cli --ns ns1.internal/10.x.y.z1 --ns ns2.internal/10.x.y.z2

This mode of testing is originally meant to test a zone before changing the delegation from the parent zone (i.e. you are done setting up your authoritative name servers for your domain and you want to do a pre-flight check before asking your registrar to change the name servers for that domain), but it should work for this use case too.

[juju4]

Thanks a lot. that's working (just add target domain at the end and may want to no-ipv6 too)

[matsduf]

man zonemaster-cli on a computer where zonemaster-cli is installed will give you the full set of options.