diff --git a/ee/app/models/remote_development/remote_development_agent_config.rb b/ee/app/models/remote_development/remote_development_agent_config.rb
index 6bf3718aefdfa60fcf46e83f0b4d0547e1d1be51..6233570b0b0458f88850e1afe2e3c6cdc8f5e204 100644
--- a/ee/app/models/remote_development/remote_development_agent_config.rb
+++ b/ee/app/models/remote_development/remote_development_agent_config.rb
@@ -12,6 +12,7 @@ class RemoteDevelopmentAgentConfig < ApplicationRecord
 
     validates :enabled, presence: true
     validates :agent, presence: true
+    validates :dns_zone, hostname: true
 
     # TODO: https://gitlab.com/gitlab-org/gitlab/-/issues/409772 - Make this a type:enum
     validates :enabled, inclusion: { in: [true], message: 'is currently immutable, and must be set to true' }
diff --git a/ee/spec/lib/remote_development/agent_config/update_processor_spec.rb b/ee/spec/lib/remote_development/agent_config/update_processor_spec.rb
index f5ad206b3f9401b43bed34ec3b3ccbac9f03a2e7..29f010317d1326a572c2c7ce68a5d763c957db81 100644
--- a/ee/spec/lib/remote_development/agent_config/update_processor_spec.rb
+++ b/ee/spec/lib/remote_development/agent_config/update_processor_spec.rb
@@ -67,6 +67,21 @@
           expect(config_instance).to be_nil
         end
       end
+
+      context 'when dns_zone is invalid' do
+        let(:dns_zone) { "invalid dns zone" }
+
+        it 'does not create the record and returns error' do
+          result = subject
+
+          expect(result[0]).to be_nil
+          expect(result[1].message).to match(/Error.*Dns zone.*/)
+          expect(result[1].reason).to eq(:bad_request)
+
+          config_instance = agent.reload.remote_development_agent_config
+          expect(config_instance).to be_nil
+        end
+      end
     end
   end
 end
diff --git a/ee/spec/models/remote_development/remote_development_agent_config_spec.rb b/ee/spec/models/remote_development/remote_development_agent_config_spec.rb
index 24aac01450ad87f596ab2999b6c971e5e05e2924..7e1ff9c4ceb3a905c3eb3420770d9af4e098ce00 100644
--- a/ee/spec/models/remote_development/remote_development_agent_config_spec.rb
+++ b/ee/spec/models/remote_development/remote_development_agent_config_spec.rb
@@ -29,4 +29,18 @@
         .to match_array(['Dns zone is currently immutable, and cannot be updated. Create a new agent instead.'])
     end
   end
+
+  describe 'validations' do
+    context 'when config has an invalid dns_zone' do
+      let_it_be(:config) { build(:remote_development_agent_config, dns_zone: "invalid dns zone") }
+
+      subject { config }
+
+      it 'prevents config from being created' do
+        subject.save # rubocop:disable Rails/SaveBang
+        expect(subject.errors.full_messages)
+          .to match_array(['Dns zone contains invalid characters (valid characters: [a-z0-9\\-])'])
+      end
+    end
+  end
 end