Zonemaster

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable fit. The all-in-one container uses roughly 300 MiB and leaves over 3 GiB free, even while running several domain tests at once.

In the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp for the web interface (and 443/tcp once you add TLS).

The web GUI is served over plain HTTP on port 80 behind HTTP Basic Auth. For production, put it behind TLS with your own domain (see Step 11).

Step 1 - Deploy from the Azure Marketplace

• In the Azure portal, choose Create a resource and search the Marketplace for the SecureAnyCloud Zonemaster offer.
• Select the plan, then choose Create.
• On the Basics tab, pick your subscription, resource group and region, name the VM, and select Standard_B2s (or larger).
• Choose SSH public key authentication, enter the admin username azureuser and provide your public key.
• On the Networking tab, allow inbound 22/tcp from your management network and 80/tcp for the web interface.
• Review and create the VM. When it is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

az vm image terms accept --urn sac1647283583153:zonemaster:default:latest
az vm create \
  --resource-group my-zonemaster-rg \
  --name zonemaster \
  --image sac1647283583153:zonemaster:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# Open the port the web interface needs (SSH is opened by default):
az vm open-port --resource-group my-zonemaster-rg --name zonemaster --port 80 --priority 900

Step 3 - Connect to your VM

Replace <vm-ip> with your VM's public IP address:

ssh azureuser@<vm-ip>

Step 4 - Confirm the services are running

Docker, the Zonemaster all-in-one container and nginx all come up automatically on first boot. Confirm that they are active:

sudo systemctl is-active docker zonemaster nginx

Expected output:

active active active

The whole stack runs as a single official container. The web GUI is published only to the loopback interface (127.0.0.1:8080), with nginx in front on port 80. The backend JSON-RPC API (:5000), the test agent and the SQLite results database never leave the container network.

Step 5 - Secure by default: a unique credential and closed internal ports

Zonemaster has no built-in login, and its public instances are open. On a public server, that is a risk. The SecureAnyCloud image closes it.

On first boot, before the port is reachable, the image generates a unique HTTP Basic Auth credential for this VM (user admin plus a random password). The web GUI is therefore protected from the moment it is reachable. A request with no credential is rejected, a wrong password is rejected, and only the per-VM credential is accepted. The backend API and results database are never reachable on a routable port.

Run the round-trip check to confirm this:

sudo /usr/local/sbin/zonemaster-roundtrip.sh

Expected output is an OK line that proves the whole model, then a rejected request with no authentication:

OK zonemaster: no-auth 401; per-VM cred authenticates; wrong-cred 401; anon /api 401; zonemaster.net graded report 84 results across 10 modules; internal :5000/:8080 refused off-box no-auth GET / -> 401

Step 6 - Read your per-VM credential

Your unique web credential is written to a root-only file. Read it:

sudo cat /root/zonemaster-credentials.txt

The file holds the web URL, the user name (admin) and the per-VM password. Keep it safe.

Step 7 - Sign in to the web GUI

Open http://<vm-ip>/ in your browser. Your browser prompts for the HTTP Basic Auth credential. Sign in with the user admin and the password from the credentials file. The Zonemaster domain checkup page opens.

Step 8 - Run your first domain test

Type a domain into the box, for example zonemaster.net, and select Run test. Zonemaster investigates the zone from the root of the DNS tree down to the domain's own authoritative nameservers, then presents a graded report.

The Filter severity levels row summarises the findings as Info, Notice, Warning, Error and Critical, with a count beside each level. You can see the health of the zone at a glance.

Step 9 - Read the graded report by module

The report groups its findings into the Zonemaster test modules: System, Basic, Address, Connectivity, Consistency, Delegation, DNSSEC, Nameserver, Syntax and Zone. Each module carries a badge with its per-severity result counts. A module expands to show its individual test cases, each with a severity and an explanation.

Use Expand all modules to open them all, or use the search box to find a specific message.

Step 10 - Automate with the JSON-RPC API

The same backend that powers the GUI exposes a JSON-RPC API behind the same Basic Auth, so you can drive tests from scripts. The following commands read your credential and ask for the component versions:

U=$(sudo grep '^ZONEMASTER_USER=' /root/zonemaster-credentials.txt | cut -d= -f2)
P=$(sudo grep '^ZONEMASTER_PASSWORD=' /root/zonemaster-credentials.txt | cut -d= -f2)
curl -s -u "$U:$P" -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"version_info"}' http://127.0.0.1/api/

Expected output lists the component versions that ship in the image:

{"result":{"zonemaster_backend":"12.1.1","zonemaster_engine":"v9.0.0","zonemaster_ldns":"5.1.0"},"id":1,"jsonrpc":"2.0"}

To run a test, start it for a domain and note the returned test id. Poll test_progress until it reaches 100, then call get_test_results with that id to retrieve the graded report as JSON.

Step 11 - Production: your own domain with TLS

The web GUI is served over plain HTTP on port 80 behind HTTP Basic Auth. For production, point a DNS record at the VM and add TLS. A common approach is to add a certificate to nginx with Certbot. Install it first:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d zonemaster.example.com

To change the web credential, set a new password for the admin user and reload nginx:

sudo htpasswd -bB /etc/nginx/.zonemaster.htpasswd admin '<new-password>'
sudo systemctl reload nginx

Support

Every SecureAnyCloud image includes 24/7 support. If you have any questions about deploying or operating Zonemaster on Azure, contact the SecureAnyCloud team through the Azure Marketplace listing or at secureanycloud.com.

Deploy on Azure

Launch Zonemaster on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com