diff --git a/roles/knot/tasks/02-configure.yaml b/roles/knot/tasks/02-configure.yaml
index a2a8e55..e79143f 100644
--- a/roles/knot/tasks/02-configure.yaml
+++ b/roles/knot/tasks/02-configure.yaml
@@ -33,6 +33,7 @@
     owner: knot
     group: knot
     mode: u=rw,g=r
+    validate: "kzonecheck -v -o '{{ item.domain }}' %s"
 
 # this seems weird but hear me out:
 # if we don't disable SLAAC, the node automatically gets an address based on IPv6 Router-Advertisements