diff --git a/API.txt b/API.txt
index cb0eb514f..b7ea174c0 100644
--- a/API.txt
+++ b/API.txt
@@ -697,11 +697,11 @@ args: 1,18,3
 arg: Str('idnsname', attribute=True, cli_name='name', label=Gettext('Zone name', domain='ipa', localedir=None), multivalue=False, normalizer=<lambda>, primary_key=True, required=True)
 option: Str('idnssoamname', attribute=True, cli_name='name_server', label=Gettext('Authoritative name server', domain='ipa', localedir=None), multivalue=False, required=True)
 option: Str('idnssoarname', attribute=True, cli_name='admin_email', default_from=DefaultFrom(<lambda>, 'idnsname'), label=Gettext('Administrator e-mail address', domain='ipa', localedir=None), multivalue=False, normalizer=_rname_normalizer, required=True)
-option: Int('idnssoaserial', attribute=True, autofill=True, cli_name='serial', create_default=_create_zone_serial, label=Gettext('SOA serial', domain='ipa', localedir=None), multivalue=False, required=False)
-option: Int('idnssoarefresh', attribute=True, autofill=True, cli_name='refresh', default=3600, label=Gettext('SOA refresh', domain='ipa', localedir=None), multivalue=False, required=False)
-option: Int('idnssoaretry', attribute=True, autofill=True, cli_name='retry', default=900, label=Gettext('SOA retry', domain='ipa', localedir=None), multivalue=False, required=False)
-option: Int('idnssoaexpire', attribute=True, autofill=True, cli_name='expire', default=1209600, label=Gettext('SOA expire', domain='ipa', localedir=None), multivalue=False, required=False)
-option: Int('idnssoaminimum', attribute=True, autofill=True, cli_name='minimum', default=3600, label=Gettext('SOA minimum', domain='ipa', localedir=None), multivalue=False, required=False)
+option: Int('idnssoaserial', attribute=True, autofill=True, cli_name='serial', create_default=_create_zone_serial, label=Gettext('SOA serial', domain='ipa', localedir=None), minvalue=1, multivalue=False, required=False)
+option: Int('idnssoarefresh', attribute=True, autofill=True, cli_name='refresh', default=3600, label=Gettext('SOA refresh', domain='ipa', localedir=None), minvalue=0, multivalue=False, required=False)
+option: Int('idnssoaretry', attribute=True, autofill=True, cli_name='retry', default=900, label=Gettext('SOA retry', domain='ipa', localedir=None), minvalue=0, multivalue=False, required=False)
+option: Int('idnssoaexpire', attribute=True, autofill=True, cli_name='expire', default=1209600, label=Gettext('SOA expire', domain='ipa', localedir=None), minvalue=0, multivalue=False, required=False)
+option: Int('idnssoaminimum', attribute=True, autofill=True, cli_name='minimum', default=3600, label=Gettext('SOA minimum', domain='ipa', localedir=None), maxvalue=10800, minvalue=0, multivalue=False, required=False)
 option: Int('dnsttl', attribute=True, cli_name='ttl', label=Gettext('SOA time to live', domain='ipa', localedir=None), multivalue=False, required=False)
 option: StrEnum('dnsclass', attribute=True, cli_name='class', label=Gettext('SOA class', domain='ipa', localedir=None), multivalue=False, required=False, values=(u'IN', u'CS', u'CH', u'HS'))
 option: Str('idnsupdatepolicy', attribute=True, cli_name='update_policy', label=Gettext('BIND update policy', domain='ipa', localedir=None), multivalue=False, required=False)
@@ -741,11 +741,11 @@ arg: Str('criteria?')
 option: Str('idnsname', attribute=True, autofill=False, cli_name='name', label=Gettext('Zone name', domain='ipa', localedir=None), multivalue=False, normalizer=<lambda>, primary_key=True, query=True, required=False)
 option: Str('idnssoamname', attribute=True, autofill=False, cli_name='name_server', label=Gettext('Authoritative name server', domain='ipa', localedir=None), multivalue=False, query=True, required=False)
 option: Str('idnssoarname', attribute=True, autofill=False, cli_name='admin_email', default_from=DefaultFrom(<lambda>, 'idnsname'), label=Gettext('Administrator e-mail address', domain='ipa', localedir=None), multivalue=False, normalizer=_rname_normalizer, query=True, required=False)
-option: Int('idnssoaserial', attribute=True, autofill=False, cli_name='serial', create_default=_create_zone_serial, label=Gettext('SOA serial', domain='ipa', localedir=None), multivalue=False, query=True, required=False)
-option: Int('idnssoarefresh', attribute=True, autofill=False, cli_name='refresh', default=3600, label=Gettext('SOA refresh', domain='ipa', localedir=None), multivalue=False, query=True, required=False)
-option: Int('idnssoaretry', attribute=True, autofill=False, cli_name='retry', default=900, label=Gettext('SOA retry', domain='ipa', localedir=None), multivalue=False, query=True, required=False)
-option: Int('idnssoaexpire', attribute=True, autofill=False, cli_name='expire', default=1209600, label=Gettext('SOA expire', domain='ipa', localedir=None), multivalue=False, query=True, required=False)
-option: Int('idnssoaminimum', attribute=True, autofill=False, cli_name='minimum', default=3600, label=Gettext('SOA minimum', domain='ipa', localedir=None), multivalue=False, query=True, required=False)
+option: Int('idnssoaserial', attribute=True, autofill=False, cli_name='serial', create_default=_create_zone_serial, label=Gettext('SOA serial', domain='ipa', localedir=None), minvalue=1, multivalue=False, query=True, required=False)
+option: Int('idnssoarefresh', attribute=True, autofill=False, cli_name='refresh', default=3600, label=Gettext('SOA refresh', domain='ipa', localedir=None), minvalue=0, multivalue=False, query=True, required=False)
+option: Int('idnssoaretry', attribute=True, autofill=False, cli_name='retry', default=900, label=Gettext('SOA retry', domain='ipa', localedir=None), minvalue=0, multivalue=False, query=True, required=False)
+option: Int('idnssoaexpire', attribute=True, autofill=False, cli_name='expire', default=1209600, label=Gettext('SOA expire', domain='ipa', localedir=None), minvalue=0, multivalue=False, query=True, required=False)
+option: Int('idnssoaminimum', attribute=True, autofill=False, cli_name='minimum', default=3600, label=Gettext('SOA minimum', domain='ipa', localedir=None), maxvalue=10800, minvalue=0, multivalue=False, query=True, required=False)
 option: Int('dnsttl', attribute=True, autofill=False, cli_name='ttl', label=Gettext('SOA time to live', domain='ipa', localedir=None), multivalue=False, query=True, required=False)
 option: StrEnum('dnsclass', attribute=True, autofill=False, cli_name='class', label=Gettext('SOA class', domain='ipa', localedir=None), multivalue=False, query=True, required=False, values=(u'IN', u'CS', u'CH', u'HS'))
 option: Str('idnsupdatepolicy', attribute=True, autofill=False, cli_name='update_policy', label=Gettext('BIND update policy', domain='ipa', localedir=None), multivalue=False, query=True, required=False)
@@ -765,11 +765,11 @@ args: 1,17,3
 arg: Str('idnsname', attribute=True, cli_name='name', label=Gettext('Zone name', domain='ipa', localedir=None), multivalue=False, normalizer=<lambda>, primary_key=True, query=True, required=True)
 option: Str('idnssoamname', attribute=True, autofill=False, cli_name='name_server', label=Gettext('Authoritative name server', domain='ipa', localedir=None), multivalue=False, required=False)
 option: Str('idnssoarname', attribute=True, autofill=False, cli_name='admin_email', default_from=DefaultFrom(<lambda>, 'idnsname'), label=Gettext('Administrator e-mail address', domain='ipa', localedir=None), multivalue=False, normalizer=_rname_normalizer, required=False)
-option: Int('idnssoaserial', attribute=True, autofill=False, cli_name='serial', create_default=_create_zone_serial, label=Gettext('SOA serial', domain='ipa', localedir=None), multivalue=False, required=False)
-option: Int('idnssoarefresh', attribute=True, autofill=False, cli_name='refresh', default=3600, label=Gettext('SOA refresh', domain='ipa', localedir=None), multivalue=False, required=False)
-option: Int('idnssoaretry', attribute=True, autofill=False, cli_name='retry', default=900, label=Gettext('SOA retry', domain='ipa', localedir=None), multivalue=False, required=False)
-option: Int('idnssoaexpire', attribute=True, autofill=False, cli_name='expire', default=1209600, label=Gettext('SOA expire', domain='ipa', localedir=None), multivalue=False, required=False)
-option: Int('idnssoaminimum', attribute=True, autofill=False, cli_name='minimum', default=3600, label=Gettext('SOA minimum', domain='ipa', localedir=None), multivalue=False, required=False)
+option: Int('idnssoaserial', attribute=True, autofill=False, cli_name='serial', create_default=_create_zone_serial, label=Gettext('SOA serial', domain='ipa', localedir=None), minvalue=1, multivalue=False, required=False)
+option: Int('idnssoarefresh', attribute=True, autofill=False, cli_name='refresh', default=3600, label=Gettext('SOA refresh', domain='ipa', localedir=None), minvalue=0, multivalue=False, required=False)
+option: Int('idnssoaretry', attribute=True, autofill=False, cli_name='retry', default=900, label=Gettext('SOA retry', domain='ipa', localedir=None), minvalue=0, multivalue=False, required=False)
+option: Int('idnssoaexpire', attribute=True, autofill=False, cli_name='expire', default=1209600, label=Gettext('SOA expire', domain='ipa', localedir=None), minvalue=0, multivalue=False, required=False)
+option: Int('idnssoaminimum', attribute=True, autofill=False, cli_name='minimum', default=3600, label=Gettext('SOA minimum', domain='ipa', localedir=None), maxvalue=10800, minvalue=0, multivalue=False, required=False)
 option: Int('dnsttl', attribute=True, autofill=False, cli_name='ttl', label=Gettext('SOA time to live', domain='ipa', localedir=None), multivalue=False, required=False)
 option: StrEnum('dnsclass', attribute=True, autofill=False, cli_name='class', label=Gettext('SOA class', domain='ipa', localedir=None), multivalue=False, required=False, values=(u'IN', u'CS', u'CH', u'HS'))
 option: Str('idnsupdatepolicy', attribute=True, autofill=False, cli_name='update_policy', label=Gettext('BIND update policy', domain='ipa', localedir=None), multivalue=False, required=False)
diff --git a/ipalib/plugins/dns.py b/ipalib/plugins/dns.py
index 0c7f1afb7..ed2f955c6 100644
--- a/ipalib/plugins/dns.py
+++ b/ipalib/plugins/dns.py
@@ -235,6 +235,7 @@ class dnszone(LDAPObject):
             cli_name='serial',
             label=_('SOA serial'),
             doc=_('SOA record serial number'),
+            minvalue=1,
             create_default=_create_zone_serial,
             autofill=True,
         ),
@@ -242,6 +243,7 @@ class dnszone(LDAPObject):
             cli_name='refresh',
             label=_('SOA refresh'),
             doc=_('SOA record refresh time'),
+            minvalue=0,
             default=3600,
             autofill=True,
         ),
@@ -249,6 +251,7 @@ class dnszone(LDAPObject):
             cli_name='retry',
             label=_('SOA retry'),
             doc=_('SOA record retry time'),
+            minvalue=0,
             default=900,
             autofill=True,
         ),
@@ -257,13 +260,16 @@ class dnszone(LDAPObject):
             label=_('SOA expire'),
             doc=_('SOA record expire time'),
             default=1209600,
+            minvalue=0,
             autofill=True,
         ),
         Int('idnssoaminimum?',
             cli_name='minimum',
             label=_('SOA minimum'),
-            doc=_('SOA record minimum value'),
+            doc=_('How long should negative responses be cached'),
             default=3600,
+            minvalue=0,
+            maxvalue=10800,
             autofill=True,
         ),
         Int('dnsttl?',