diff --git a/config_test.go b/config_test.go
new file mode 100644
index 0000000..db59f95
--- /dev/null
+++ b/config_test.go
@@ -0,0 +1,458 @@
+package main
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestPrepareConfig(t *testing.T) {
+	tests := []struct {
+		name         string
+		users        []User
+		rrconfigs    []RRConfig
+		expSuccess   bool
+		expUsers     map[string]*User
+		expRrconfigs map[string]*RRConfig
+	}{
+		{
+			"empty config",
+			nil,
+			nil,
+			false,
+			map[string]*User{},
+			map[string]*RRConfig{},
+		},
+		{
+			"simple config",
+			[]User{
+				User{
+					Username: "user",
+					Password: "pass",
+					Records: []string{
+						"record.example.org",
+					},
+				},
+			},
+			[]RRConfig{
+				RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+			},
+			true,
+			map[string]*User{
+				"user": &User{
+					Username: "user",
+					Password: "pass",
+					Records: []string{
+						"record.example.org",
+					},
+					records: map[string]bool{
+						"record.example.org": true,
+					},
+				},
+			},
+			map[string]*RRConfig{
+				"record.example.org": &RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+			},
+		},
+		{
+			"more complex config",
+			[]User{
+				User{
+					Username: "user",
+					Password: "pass",
+					Records: []string{
+						"record.example.org",
+						"record2.example.org",
+					},
+				},
+				User{
+					Username: "user2",
+					Password: "pass2",
+					Records: []string{
+						"record.example.com",
+					},
+				},
+			},
+			[]RRConfig{
+				RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+				RRConfig{
+					Recordname: "record2.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-other-secret-key",
+				},
+				RRConfig{
+					Recordname: "record.example.com",
+					Zonename:   "zone.example.com",
+					Nameserver: "ns1.example.com",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "one-more-secret-key",
+				},
+			},
+			true,
+			map[string]*User{
+				"user": &User{
+					Username: "user",
+					Password: "pass",
+					Records: []string{
+						"record.example.org",
+						"record2.example.org",
+					},
+					records: map[string]bool{
+						"record.example.org":  true,
+						"record2.example.org": true,
+					},
+				},
+				"user2": &User{
+					Username: "user2",
+					Password: "pass2",
+					Records: []string{
+						"record.example.com",
+					},
+					records: map[string]bool{
+						"record.example.com": true,
+					},
+				},
+			},
+			map[string]*RRConfig{
+				"record.example.org": &RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+				"record2.example.org": &RRConfig{
+					Recordname: "record2.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-other-secret-key",
+				},
+				"record.example.com": &RRConfig{
+					Recordname: "record.example.com",
+					Zonename:   "zone.example.com",
+					Nameserver: "ns1.example.com",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "one-more-secret-key",
+				},
+			},
+		},
+		{
+			"no users config",
+			nil,
+			[]RRConfig{
+				RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+			},
+			false,
+			nil,
+			nil,
+		},
+		{
+			"no records config",
+			[]User{
+				User{
+					Username: "user",
+					Password: "pass",
+					Records: []string{
+						"record.example.org",
+					},
+				},
+			},
+			nil,
+			false,
+			nil,
+			nil,
+		},
+		{
+			"duplicate user",
+			[]User{
+				User{
+					Username: "user",
+					Password: "pass",
+					Records: []string{
+						"record.example.org",
+					},
+				},
+				User{
+					Username: "user",
+					Password: "pass2",
+					Records: []string{
+						"record2.example.org",
+					},
+				},
+			},
+			[]RRConfig{
+				RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+			},
+			false,
+			nil,
+			nil,
+		},
+		{
+			"duplicate record",
+			[]User{
+				User{
+					Username: "user",
+					Password: "pass",
+					Records: []string{
+						"record.example.org",
+					},
+				},
+			},
+			[]RRConfig{
+				RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+				RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+			},
+			false,
+			nil,
+			nil,
+		},
+		{
+			"missing user config",
+			[]User{
+				User{
+					Username: "user",
+					Password: "pass",
+					Records: []string{
+						"record.example.org",
+					},
+				},
+			},
+			[]RRConfig{
+				RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+				RRConfig{
+					Recordname: "record2.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+			},
+			false,
+			nil,
+			nil,
+		},
+		{
+			"missing record/one user config",
+			[]User{
+				User{
+					Username: "user",
+					Password: "pass",
+					Records: []string{
+						"record.example.org",
+						"record2.example.org",
+					},
+				},
+			},
+			[]RRConfig{
+				RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+			},
+			false,
+			nil,
+			nil,
+		},
+		{
+			"missing record/multiple users config",
+			[]User{
+				User{
+					Username: "user",
+					Password: "pass",
+					Records: []string{
+						"record.example.org",
+					},
+				},
+				User{
+					Username: "user2",
+					Password: "pass",
+					Records: []string{
+						"record2.example.org",
+					},
+				},
+			},
+			[]RRConfig{
+				RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+			},
+			false,
+			nil,
+			nil,
+		},
+		{
+			"record reuse config",
+			[]User{
+				User{
+					Username: "user",
+					Password: "pass",
+					Records: []string{
+						"record.example.org",
+					},
+				},
+				User{
+					Username: "user2",
+					Password: "pass2",
+					Records: []string{
+						"record.example.org",
+					},
+				},
+			},
+			[]RRConfig{
+				RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+			},
+			false,
+			nil,
+			nil,
+		},
+		{
+			"user without records config",
+			[]User{
+				User{
+					Username: "user",
+					Password: "pass",
+					Records:  []string{},
+				},
+				User{
+					Username: "user2",
+					Password: "pass2",
+					Records: []string{
+						"record.example.org",
+					},
+				},
+			},
+			[]RRConfig{
+				RRConfig{
+					Recordname: "record.example.org",
+					Zonename:   "zone.example.org",
+					Nameserver: "ns1.example.org",
+					Tsigalgo:   "hmac-sha256",
+					Tsigid:     "tsig-id",
+					Tsigkey:    "some-secret-key",
+				},
+			},
+			false,
+			nil,
+			nil,
+		},
+	}
+
+	for _, tc := range tests {
+		cfg := Config{
+			ServerPort: 1234,
+			Users:      tc.users,
+			RRConfigs:  tc.rrconfigs,
+		}
+		res, err := prepareConfig(&cfg)
+
+		// check for error
+		if tc.expSuccess && err != nil {
+			// prepareConfig failed even though it should not have
+			t.Errorf("%s: err == nil: %v, expected: %v (err was: %v)", tc.name,
+				err == nil, tc.expSuccess, err)
+		} else if !tc.expSuccess && err == nil {
+			// prepareConfig succeeded even though it should have failed
+			t.Errorf("%s: err == nil: %v, expected: %v", tc.name,
+				err == nil, tc.expSuccess)
+		}
+
+		// check whether result is valid on success
+		if err == nil && res == nil {
+			t.Errorf("%s: res is nil even though it should not be", tc.name)
+		}
+
+		// try to compare res with expected values only if res is not nil
+		if res != nil {
+			if !reflect.DeepEqual(tc.expUsers, res.users) {
+				t.Errorf("%s: cfg.users: %s", tc.name,
+					cmp.Diff(tc.expUsers, res.users, cmp.AllowUnexported(User{})))
+			}
+			if !reflect.DeepEqual(tc.expRrconfigs, res.rrconfigs) {
+				t.Errorf("%s: cfg.rrconfigs: %s", tc.name,
+					cmp.Diff(tc.expRrconfigs, res.rrconfigs))
+			}
+		}
+	}
+}
diff --git a/go.mod b/go.mod
index 9888fba..ceb930b 100644
--- a/go.mod
+++ b/go.mod
@@ -3,6 +3,7 @@ module git.preisner.eu/preisi/dyndns-server
 go 1.16
 
 require (
+	github.com/google/go-cmp v0.5.6
 	github.com/pelletier/go-toml v1.9.3
 	golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97
 )
diff --git a/go.sum b/go.sum
index 13aad2f..bcce186 100644
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,7 @@
+github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/pelletier/go-toml v1.9.3 h1:zeC5b1GviRUyKYd6OJPvBU/mcVDVoL1OhT17FCt5dSQ=
 github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e h1:gsTQYXdTw2Gq7RBsWvlQ91b+aEQ6bXFUngBGuR8sPpI=
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 h1:/UOmuWzQfxxo9UtlXMwuQU8CMgg1eZXqTRwkSQJWKOI=
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
@@ -10,3 +10,5 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=