diff --git a/app/models/domain.rb b/app/models/domain.rb
index 06e50bf..deafa86 100644
--- a/app/models/domain.rb
+++ b/app/models/domain.rb
@@ -1,105 +1,110 @@
 class Domain < ActiveRecord::Base
   self.inheritance_column = :nx
 
   # List all supported domain types.
   def self.domain_types
     [
       'NATIVE',
       'MASTER',
       'SLAVE',
     ]
   end
 
+  # List domain types that can be created.
+  def self.allowed_domain_types
+    domain_types - WebDNS.settings[:prohibit_domain_types]
+  end
+
   belongs_to :group
   has_many :records
   # BUG in bump_serial_trigger
   has_one :soa, -> { unscope(where: :type) }, class_name: SOA
 
   validates :group_id, presence: true
   validates :name, uniqueness: true, presence: true
   validates :type, presence: true, inclusion: { in: domain_types }
   validates :master, presence: true, ipv4: true, if: :slave?
 
   after_create :generate_soa
   after_create :generate_ns
 
   attr_writer :serial_strategy
 
   # Get the zone's serial strategy.
   #
   # Returns one of the supported serial strategies.
   def serial_strategy
     @serial_strategy ||= WebDNS.settings[:serial_strategy]
   end
 
   # Returns true if this a reverse zone.
   def reverse?
     name.end_with?('.in-addr.arpa') || name.end_with?('.ip6.arpa')
   end
 
   # Returns true if this a ENUM zone.
   def enum?
     name.end_with?('.e164.arpa')
   end
 
   # Returns true if this is a slave zone.
   def slave?
     type == 'SLAVE'
   end
 
   # Compute subnet for reverse records
   def subnet
     return if not reverse?
 
     if name.end_with?('.in-addr.arpa')
       subnet_v4
     elsif name.end_with?('.ip6.arpa')
       subnet_v6
     end
   end
 
   private
 
   def subnet_v4
     # get ip octets (remove .in-addr.arpa)
     octets = name.split('.')[0...-2].reverse
     return if octets.any? { |_| false }
 
     mask = 8 * octets.size
     octets += [0, 0, 0, 0]
 
     ip = IPAddr.new octets[0, 4].join('.')
 
     [ip, mask].join('/')
   end
 
   def subnet_v6
     nibbles = name.split('.')[0...-2].reverse
     return if nibbles.any? { |_| false }
 
     mask = 4 * nibbles.size
     nibbles += [0] * 32
 
     ip = IPAddr.new nibbles[0, 32].in_groups_of(4).map(&:join).join(':')
 
     [ip, mask].join('/')
   end
 
   # Hooks
 
   def generate_soa
     soa_record = SOA.new(domain: self)
 
     soa_record.save!
   end
 
   def generate_ns
     return if slave?
     return if WebDNS.settings[:default_ns].empty?
 
     WebDNS.settings[:default_ns].each { |ns|
       Record.find_or_create_by!(domain: self, type: 'NS', name: '', content: ns)
     }
   end
 
 end
diff --git a/app/views/domains/_form.html.erb b/app/views/domains/_form.html.erb
index 3e1962d..6a32f42 100644
--- a/app/views/domains/_form.html.erb
+++ b/app/views/domains/_form.html.erb
@@ -1,7 +1,7 @@
 <%= bootstrap_form_for(@domain, layout: :horizontal, label_col: 'col-sm-2', control_col: 'col-sm-4') do |f| %>
   <%= f.text_field :name %>
   <%= f.collection_select :group_id, edit_group_scope, :id, :name %>
-  <%= f.select :type, Domain.domain_types %>
+  <%= f.select :type, Domain.allowed_domain_types %>
   <%= f.text_field :master, wrapper_class: 'hidden' %>
   <%= f.submit 'Save', class: 'btn btn-primary col-sm-offset-2' %>
 <% end %>
diff --git a/config/initializers/00_settings.rb b/config/initializers/00_settings.rb
index d92c3e0..4134800 100644
--- a/config/initializers/00_settings.rb
+++ b/config/initializers/00_settings.rb
@@ -1,25 +1,26 @@
 WebDNS.settings[:soa_defaults] = {
   primary_ns: 'ns1.example.com',
   contact: 'domainmaster@example.com',
   serial: 1,
   refresh: 10_800,
   retry: 3600,
   expire: 604_800,
   nx: 3600
 }
 WebDNS.settings[:default_ns] = [
   'ns1.example.com',
   'ns2.example.com'
 ]
 
 WebDNS.settings[:serial_strategy] = Strategies::Date
 
 WebDNS.settings[:prohibit_records_types] = []
+WebDNS.settings[:prohibit_domain_types] = ['NATIVE']
 
 WebDNS.settings[:contact_mail] = 'webdns@example.com'
 WebDNS.settings[:mail_from] = 'webdns@example.com'
 WebDNS.settings[:admin_group] = 'admin'
 
 # Allow local overrides
 local_settings = File.expand_path('../../local_settings.rb', __FILE__)
 require_relative local_settings if File.exist?(local_settings)