{"record":{"id":"7f9c46d57b5fd251","repo":"kubernetes/kops","slug":"error-doing-dns-lookup-for-ns-records-for-q-v","errorCode":null,"errorMessage":"error doing DNS lookup for NS records for %q: %v","messagePattern":"error doing DNS lookup for NS records for %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/dns.go","lineNumber":109,"sourceCode":"func validateDNS(cluster *kops.Cluster, cloud fi.Cloud) error {\n\tif !cluster.PublishesDNSRecords() || cluster.UsesPrivateDNS() {\n\t\tklog.V(2).Infof(\"Skipping DNS validation for non-public DNS\")\n\t\treturn nil\n\t}\n\n\tzone, err := findZone(cluster, cloud)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif zone == nil {\n\t\treturn nil\n\t}\n\tdnsName := strings.TrimSuffix(zone.Name(), \".\")\n\n\tklog.V(2).Infof(\"Doing DNS lookup to verify NS records for %q\", dnsName)\n\tns, err := net.LookupNS(dnsName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error doing DNS lookup for NS records for %q: %v\", dnsName, err)\n\t}\n\n\tif len(ns) == 0 {\n\t\tif os.Getenv(\"DNS_IGNORE_NS_CHECK\") == \"\" {\n\t\t\treturn fmt.Errorf(\"NS records not found for %q - please make sure they are correctly configured\", dnsName)\n\t\t}\n\t\tklog.Warningf(\"Ignoring failed NS record check because DNS_IGNORE_NS_CHECK is set\")\n\t} else {\n\t\tvar hosts []string\n\t\tfor _, n := range ns {\n\t\t\thosts = append(hosts, n.Host)\n\t\t}\n\t\tklog.V(2).Infof(\"Found NS records for %q: %v\", dnsName, hosts)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/dns.go#L91-L127","documentation":"During cluster validation, kOps verifies that the DNS zone backing the cluster's domain actually has NS records by performing a Go net.LookupNS on the zone name. If the resolver returns an error (network failure, missing zone, DNS outage), validateDNS wraps it in this message. It aborts cluster creation/update because kOps cannot confirm the zone will resolve.","triggerScenarios":"Running `kops create cluster`/`kops update cluster` when the zone's DNS is unresolvable: the hosted zone does not exist yet, nameservers are not delegated, the local resolver cannot reach authoritative servers, or the DNS provider API is healthy but the zone name is wrong (e.g. wrong suffix in --dns-zone).","commonSituations":"User created the hosted zone seconds earlier and delegation hasn't propagated; private zone with a resolver that can't see it; typo in domain; corporate firewall blocks outbound DNS on UDP/TCP 53; SOA exists but NS records were accidentally deleted.","solutions":["dig NS <zone-name> to confirm NS records resolve publicly; if not, fix delegation at the registrar/parent zone","Verify the hosted zone exists in the cloud DNS provider and that kOps targets the right zone (--dns-zone / DNS zone config)","Wait for delegation propagation (usually minutes, up to 48h for new zones) and retry","Check local resolver/firewall allows outbound DNS; try another resolver with dig @8.8.8.8"],"exampleFix":"// before\nexport KOPS_STATE_STORE=s3://bucket\nkops create cluster --name cluster.example.com --zones us-east-1a\n# fails: NS lookup fails because zone not delegated\n// after\n# create hosted zone, update registrar NS records first:\naws route53 create-hosted-zone --name cluster.example.com ...\n# set NS records at registrar, verify, then rerun kops create cluster","handlingStrategy":"validation","validationCode":"if _, err := net.LookupNS(\"cluster.example.com\"); err != nil {\n    return fmt.Errorf(\"pre-flight: NS lookup for cluster zone failed: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"ns, err := net.LookupNS(zone)\nif err != nil {\n    return fmt.Errorf(\"DNS zone not resolvable (%v); fix delegation or set DNS_IGNORE_NS_CHECK for testing\", err)\n}","preventionTips":["Run `dig NS <zone>` before every kops create/update","Wait for registrar delegation to propagate after creating a new hosted zone","Test DNS from the machine running kops (corporate resolvers may differ)","Ensure outbound UDP/TCP 53 is not blocked"],"tags":["dns","network","validation"],"backgroundTag":"dns-lookup-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}