A frequent issue is to forgot Bind format for DNS zones requires to add the keyword IN and the TTL information.

kzonecheck, according the documentation "checks zone file syntax and runs semantic checks on the zone content". But a sequence of tokens without a TTL and "IN" are still semantically valid.

Example of valid format:
_acme-challenge.packages.nasqueron.org. 172800 IN CNAME 82f672a3-f626-45e8-95c0-525f2288cdcb.acme.nasqueron.org.

Example of invalid format:
_acme-challenge.packages.nasqueron.org CNAME f977c866-22b2-423d-b4bf-a37bc972482f.acme.nasqueron.org.