diff --git a/bubble-server/src/main/java/bubble/model/cloud/BubbleDomain.java b/bubble-server/src/main/java/bubble/model/cloud/BubbleDomain.java
index 4f930f9a..a377f252 100644
--- a/bubble-server/src/main/java/bubble/model/cloud/BubbleDomain.java
+++ b/bubble-server/src/main/java/bubble/model/cloud/BubbleDomain.java
@@ -13,6 +13,7 @@ import org.cobbzilla.wizard.model.Identifiable;
 import org.cobbzilla.wizard.model.IdentifiableBase;
 import org.cobbzilla.wizard.model.entityconfig.annotations.*;
 import org.cobbzilla.wizard.validation.HasValue;
+import org.cobbzilla.wizard.validation.ValidationResult;
 import org.hibernate.annotations.Type;
 
 import javax.persistence.Column;
@@ -25,6 +26,7 @@ import java.util.stream.Collectors;
 
 import static bubble.ApiConstants.EP_DOMAINS;
 import static bubble.model.cloud.AnsibleRole.sameRoleName;
+import static org.apache.commons.lang3.StringUtils.countMatches;
 import static org.cobbzilla.util.daemon.ZillaRuntime.*;
 import static org.cobbzilla.util.dns.DnsType.NS;
 import static org.cobbzilla.util.dns.DnsType.SOA;
@@ -141,13 +143,23 @@ public class BubbleDomain extends IdentifiableBase implements AccountTemplate {
         return addRole(current);
     }
 
-    public String networkFromFqdn(String fqdn) {
-        if (fqdn.endsWith("."+getName())) {
-            final String prefix = fqdn.substring(0, fqdn.length() - ("." + getName()).length());
-            final int lastDot = prefix.lastIndexOf('.');
-            return lastDot == -1 ? prefix : prefix.substring(lastDot+1);
+    public String networkFromFqdn(String fqdn, ValidationResult errors) {
+        if (!fqdn.endsWith("."+getName())) {
+            errors.addViolation("err.fqdn.outOfNetwork");
+            return null;
         }
-        return die("networkFromFqdn("+fqdn+"): expected suffix ."+getName());
+        final String prefix = fqdn.substring(0, fqdn.length() - ("." + getName()).length());
+        final int dotCount = countMatches(prefix, '.');
+        if (dotCount != -1) {
+            errors.addViolation("err.fqdn.invalid");
+            return null;
+        }
+        final int lastDot = prefix.lastIndexOf('.');
+        if (lastDot == -1) {
+            errors.addViolation("err.fqdn.invalid");
+            return null;
+        }
+        return prefix.substring(lastDot+1);
     }
 
     public DnsRecordMatch matchSOA() {
diff --git a/bubble-server/src/main/java/bubble/resources/bill/AccountPlansResource.java b/bubble-server/src/main/java/bubble/resources/bill/AccountPlansResource.java
index 9634d8ba..19a2ebc1 100644
--- a/bubble-server/src/main/java/bubble/resources/bill/AccountPlansResource.java
+++ b/bubble-server/src/main/java/bubble/resources/bill/AccountPlansResource.java
@@ -23,7 +23,6 @@ import bubble.resources.account.AccountOwnedResource;
 import bubble.server.BubbleConfiguration;
 import bubble.service.AuthenticatorService;
 import lombok.extern.slf4j.Slf4j;
-import org.apache.poi.util.StringUtil;
 import org.cobbzilla.wizard.validation.ValidationResult;
 import org.glassfish.grizzly.http.server.Request;
 import org.glassfish.jersey.server.ContainerRequest;
@@ -39,7 +38,8 @@ import java.util.stream.Collectors;
 
 import static bubble.ApiConstants.*;
 import static bubble.model.cloud.BubbleNetwork.validateHostname;
-import static org.cobbzilla.util.string.ValidationRegexes.*;
+import static org.cobbzilla.util.string.ValidationRegexes.HOST_PATTERN;
+import static org.cobbzilla.util.string.ValidationRegexes.validateRegexMatches;
 import static org.cobbzilla.wizard.resources.ResourceUtil.*;
 
 @Slf4j
@@ -137,14 +137,8 @@ public class AccountPlansResource extends AccountOwnedResource<AccountPlan, Acco
                 } else if (domain != null && !forkHost.endsWith("."+domain.getName())) {
                     errors.addViolation("err.forkHost.domainMismatch");
                 } else if (domain != null) {
-                    final String nameWithoutDomain = forkHost.substring(0, forkHost.length()-domain.getName().length()-1);
-                    final int dotCount = StringUtil.countMatches(nameWithoutDomain, '.');
-                    if (dotCount != 1) {
-                        errors.addViolation("err.forkHost.invalid");
-                    } else {
-                        request.setName(nameWithoutDomain.substring(nameWithoutDomain.indexOf('.') + 1));
-                        validateHostname(request, errors);
-                    }
+                    request.setName(domain.networkFromFqdn(forkHost, errors));
+                    validateHostname(request, errors);
                 }
             }
         } else {
diff --git a/bubble-server/src/main/java/bubble/resources/cloud/NetworkActionsResource.java b/bubble-server/src/main/java/bubble/resources/cloud/NetworkActionsResource.java
index a4807742..dec6452a 100644
--- a/bubble-server/src/main/java/bubble/resources/cloud/NetworkActionsResource.java
+++ b/bubble-server/src/main/java/bubble/resources/cloud/NetworkActionsResource.java
@@ -22,6 +22,7 @@ import bubble.service.cloud.StandardNetworkService;
 import lombok.extern.slf4j.Slf4j;
 import org.cobbzilla.util.collection.NameAndValue;
 import org.cobbzilla.wizard.validation.ConstraintViolationBean;
+import org.cobbzilla.wizard.validation.ValidationResult;
 import org.glassfish.grizzly.http.server.Request;
 import org.glassfish.jersey.server.ContainerRequest;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -188,7 +189,11 @@ public class NetworkActionsResource {
         final BubbleDomain domain = domainDAO.findByFqdn(fqdn);
         if (domain == null) return invalid("err.fqdn.domain.invalid", "domain not found for "+fqdn, fqdn);
 
-        final String netName = domain.networkFromFqdn(fqdn);
+        final ValidationResult errors = new ValidationResult();
+        final String netName = domain.networkFromFqdn(fqdn, errors);
+        if (errors.isInvalid()) throw invalidEx(errors);
+        if (netName == null) throw invalidEx("err.fqdn.invalid");
+
         final BubbleNetwork network = networkDAO.findByAccountAndId(caller.getUuid(), netName);
         if (network == null) return invalid("err.fqdn.network.invalid", "network not found for "+fqdn, fqdn);
 
diff --git a/bubble-server/src/main/resources/message_templates/en_US/server/post_auth/ResourceMessages.properties b/bubble-server/src/main/resources/message_templates/en_US/server/post_auth/ResourceMessages.properties
index 4c786a8b..cbb97653 100644
--- a/bubble-server/src/main/resources/message_templates/en_US/server/post_auth/ResourceMessages.properties
+++ b/bubble-server/src/main/resources/message_templates/en_US/server/post_auth/ResourceMessages.properties
@@ -427,11 +427,11 @@ err.expiration.cannotCreateSshKeyAlreadyExpired=Expiration date has already pass
 err.footprint.required=Footprint is required
 err.forkHost.notAllowed=Fork Host is not allowed
 err.forkHost.invalid=Fork Host is not a valid hostname
-err.forkHost.domainMismatch=Fork Host domain does not match selected domain name
 err.fqdn.domain.invalid=Domain not found for FQDN
 err.fqdn.length=FQDN is too long
 err.fqdn.network.invalid=network not found for FQDN
 err.fqdn.outOfNetwork=FQDN is not in network
+err.fqdn.invalid=FQDN is not valid
 err.fqdn.plan.invalid=No plan found for network
 err.fqdn.required=FQDN is required
 err.geoService.unresolvable=Error resolving geo service
diff --git a/bubble-web b/bubble-web
index 24dd82fa..2eef2590 160000
--- a/bubble-web
+++ b/bubble-web
@@ -1 +1 @@
-Subproject commit 24dd82fa4dfe067ddc0bec0dc2db7633f663430a
+Subproject commit 2eef2590acebd2db5b27290a98b0adfd6ebb9ee2