Contact address is well-formed

The SOA carries a contact address, in a format nobody expects the first time they meet it: an email address with the @ replaced by a dot. hostmaster.example.com means hostmaster@example.com. A dot inside the local part is escaped, so john\.smith.example.com means john.smith@example.com.

This check decodes the field and tests whether the result is shaped like an address at all. It is a syntax test and not a delivery test — nothing is sent to it, and a well-formed address that bounces passes here.

It matters for one reason. It is the published route for somebody outside your organisation to tell you something is wrong with your zone, and nobody looks at it until they urgently need it. At that point the reader is a resolver operator, a researcher or another postmaster who has already decided to be helpful, and a field that does not parse is where that ends.

Use a role address that reaches a team rather than a person. hostmaster@ is the conventional choice and RFC 2142 asks for it; a named individual's address is one resignation away from being dead.

Make sure it actually accepts mail. An address that parses and bounces is worse than one that parses and is read, and it is the state most of these end up in.

If the local part needs a dot, escape it as \. — unescaped, the first dot is read as the @ and the whole address decodes to something nobody owns.

Remember it is public and machine-readable. It gets scraped, so filter accordingly rather than choosing an address you intend to ignore.