Primary nameserver is listed

The MNAME field of the SOA names the zone's primary server — the one secondaries pull from, the one NOTIFY messages are expected to come from, and the target a dynamic update is sent to. This check asks whether that name appears in the zone's published NS set.

When it does not, the usual reason is a hidden primary, and that is a deliberate and sensible design: the server holding the master copy is kept off the public list so it takes no query traffic and presents no public surface, while the secondaries that are listed do all the answering. It is reported as information rather than as a fault for exactly that reason.

The other reason is a leftover — a decommissioned host, or a name from a zone template nobody has read in years. In practice very little reads the MNAME, so a wrong one usually causes no visible harm, which is precisely why it stays wrong. The exception is RFC 2136 dynamic updates, where the MNAME is how a client finds the server to send the update to.

If you run a hidden primary, this is working as designed and nothing needs changing. It is worth confirming that is what you are looking at rather than assuming.

If the MNAME names a host that no longer exists, point it at the real primary — or, on a managed provider with no classic primary, at any of the published nameservers. It costs nothing and removes a misleading signal from the zone.

If you use dynamic updates, the MNAME has to be correct and reachable, because that is what update clients resolve to find the server to talk to.