diff --git a/scripts/setup-bind.sh b/scripts/setup-bind.sh
index 442364e..6005f4d 100755
--- a/scripts/setup-bind.sh
+++ b/scripts/setup-bind.sh
@@ -120,6 +120,11 @@ ensure_named_conf_local() {
         run chmod 640 "$NAMED_CONF_LOCAL"
     else
         log "  $NAMED_CONF_LOCAL already exists; preserving"
+        # Check for common path misconfigurations
+        if grep -q '/opt/bind' "$NAMED_CONF_LOCAL"; then
+            warn "  ⚠️  WARNING: Found '/opt/bind' path in $NAMED_CONF_LOCAL"
+            warn "  This is likely incorrect! Expected zones directory: $ZONES_DIR"
+        fi
         # Don't change ownership if file already has content — it may be managed
         # by someone else. Just make sure web process can write to it.
         run chmod 644 "$NAMED_CONF_LOCAL"
@@ -145,7 +150,17 @@ ensure_include_in_named_conf() {
 }
 
 restart_named() {
-    log "Step 5: start/enable named service"
+    log "Step 5: verify config before starting"
+    # Always validate config first
+    if ! named-checkconf >/dev/null 2>&1; then
+        err "  BIND configuration has errors!"
+        err "  Running 'named-checkconf' to show details:"
+        named-checkconf
+        exit 1
+    fi
+    log "  Configuration syntax OK"
+    
+    log "Step 6: start/enable named service"
     # Always enable and start/restart the service
     if [[ $DRY_RUN -eq 1 ]]; then
         printf '  [DRY-RUN] systemctl enable named\n'