Should Diffie-Hellman on Curve25519 be validated? I have some issues understanding the original protocol proposed by Daniel J. Bernstein for Diffie-Hellman on Curve25519. On his web page he states to not validate remote public key, but at the same time enumerates a list of bad points for "some protocols". It does not state anything about zero check after scalar multiplication.

In another question I got linked to this article about validation, but I can not see a definitive conclusion explicitly telling to not validate inputs nor outputs.

Should Diffie-Hellman on Curve25519 be validated? By validation I mean to check that input public key is not a "bad point" and check for zero on scalar multiplication result.
From DJB's page:

Don't. The Curve25519 function was carefully designed to allow all 32-byte strings as Diffie-Hellman public keys.
There are some unusual non-Diffie-Hellman elliptic-curve protocols that need to ensure &quot;contributory&quot; behavior.

So for (EC)DH using Curve25519 you don't need to validate public keys.
If you are using Curve25519 for some other elliptic curve protocol you may need to perform validation by making sure the public key isn't in some small subset of possible public keys.