diff --git a/internal/pdns/errors.go b/internal/pdns/errors.go
index 2ee6deb..2d834ab 100644
--- a/internal/pdns/errors.go
+++ b/internal/pdns/errors.go
@@ -48,6 +48,11 @@ func FriendlyMessage(err error) string {
 	case strings.Contains(detail, "RRset") && strings.Contains(detail, "IN ALIAS"):
 		return "An ALIAS record conflicts with an existing record at this name."
 	case apiErr.Status == 422:
+		// Surface the specific PowerDNS rejection reason when it doesn't match a
+		// known pattern; without it the reason is only visible in operator logs.
+		if detail != "" {
+			return "The DNS record was rejected as invalid: " + detail
+		}
 		return "The DNS record was rejected as invalid. Check the record type and value."
 	case apiErr.Status == 404:
 		return "The DNS zone could not be found. It may still be provisioning."
diff --git a/internal/pdns/errors_test.go b/internal/pdns/errors_test.go
index f820d1c..9b41105 100644
--- a/internal/pdns/errors_test.go
+++ b/internal/pdns/errors_test.go
@@ -51,9 +51,9 @@ func TestFriendlyMessage(t *testing.T) {
 			want: "The DNS record was rejected as invalid. Check the record type and value.",
 		},
 		{
-			name: "422 unknown body falls back to generic 422 message",
+			name: "422 unknown body surfaces the specific pdns detail",
 			err:  &pdnsAPIError{Status: 422, Body: `{"error": "Some other validation error"}`},
-			want: "The DNS record was rejected as invalid. Check the record type and value.",
+			want: "The DNS record was rejected as invalid: Some other validation error",
 		},
 		{
 			name: "404",