diff --git a/pkg/dns/dns_test.go b/pkg/dns/dns_test.go
new file mode 100644
index 00000000..49b414fd
--- /dev/null
+++ b/pkg/dns/dns_test.go
@@ -0,0 +1,38 @@
+package dns
+
+import (
+	"fmt"
+	"testing"
+)
+
+func TestEnsureDomainsResolveSameIPv4(t *testing.T) {
+	tests := []struct {
+		domainName     string
+		serverName     string
+		shouldValidate bool
+	}{
+		// NOTE(d1): DNS records get checked, so use something we control. if
+		// you're here because of a failing test, try `dig +short <domain>` to
+		// ensure stuff matches first!
+		{"docs.coopcloud.tech", "coopcloud.tech", true},
+		{"docs.coopcloud.tech", "swarm.autonomic.zone", true},
+
+		// NOTE(d1): special case handling for "--local"
+		{"", "default", true},
+		{"", "local", true},
+
+		{"", "", false},
+		{"123", "", false},
+	}
+
+	for _, test := range tests {
+		_, err := EnsureDomainsResolveSameIPv4(test.domainName, test.serverName)
+		if err != nil && test.shouldValidate {
+			t.Fatal(err)
+		}
+
+		if err == nil && !test.shouldValidate {
+			t.Fatal(fmt.Errorf("should have failed but did not: %v", test))
+		}
+	}
+}