diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml
index 6d9efe54..13aeb2c2 100644
--- a/.github/workflows/validation.yml
+++ b/.github/workflows/validation.yml
@@ -26,6 +26,45 @@ jobs:
         steps:
             - uses: actions/checkout@v4
 
+            - id: create_token
+              uses: tibdex/github-app-token@v2
+              with:
+               app_id: ${{ secrets.APP_ID }}
+               private_key: ${{ secrets.PRIVATE_KEY }}
+
+            - name: Check DNS
+              id: dns_check
+              uses: koenrh/dnscontrol-action@v3
+              with:
+               args: check
+               config_file: "dnsconfig.js"
+
+            - name: Add Validated DNS Label
+              if: ${{ steps.dns_check.outcome == 'success' }}
+              uses: actions-ecosystem/action-add-labels@v1
+              with:
+               labels: "Validated DNS"
+               github_token: ${{ steps.create_token.outputs.token }}
+            - name: Remove Invalid DNS Label
+              if: ${{ steps.dns_check.outcome == 'success' }}
+              uses: actions-ecosystem/action-remove-labels@v1
+              with:
+               labels: "Invalid DNS"
+               github_token: ${{ steps.create_token.outputs.token }}
+
+            - name: Add Invalid DNS Label
+              if: ${{ failure() }}
+              uses: actions-ecosystem/action-add-labels@v1
+              with:
+               labels: "Invalid DNS"
+               github_token: ${{ steps.create_token.outputs.token }}
+            - name: Remove Validated DNS Label
+              if: ${{ failure() }}
+              uses: actions-ecosystem/action-remove-labels@v1
+              with:
+               labels: "Validated DNS"
+               github_token: ${{ steps.create_token.outputs.token }}
+
             - name: Check
               uses: is-a-dev/dnscontrol-action@main
               with: