{"record":{"id":"c6ecf0036584c7ee","repo":"kubernetes/kops","slug":"ns-records-not-found-for-q-please-make-sure-the","errorCode":null,"errorMessage":"NS records not found for %q - please make sure they are correctly configured","messagePattern":"NS records not found for %q - please make sure they are correctly configured","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/dns.go","lineNumber":114,"sourceCode":"\n\tzone, err := findZone(cluster, cloud)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif zone == nil {\n\t\treturn nil\n\t}\n\tdnsName := strings.TrimSuffix(zone.Name(), \".\")\n\n\tklog.V(2).Infof(\"Doing DNS lookup to verify NS records for %q\", dnsName)\n\tns, err := net.LookupNS(dnsName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error doing DNS lookup for NS records for %q: %v\", dnsName, err)\n\t}\n\n\tif len(ns) == 0 {\n\t\tif os.Getenv(\"DNS_IGNORE_NS_CHECK\") == \"\" {\n\t\t\treturn fmt.Errorf(\"NS records not found for %q - please make sure they are correctly configured\", dnsName)\n\t\t}\n\t\tklog.Warningf(\"Ignoring failed NS record check because DNS_IGNORE_NS_CHECK is set\")\n\t} else {\n\t\tvar hosts []string\n\t\tfor _, n := range ns {\n\t\t\thosts = append(hosts, n.Host)\n\t\t}\n\t\tklog.V(2).Infof(\"Found NS records for %q: %v\", dnsName, hosts)\n\t}\n\n\treturn nil\n}\n\nfunc precreateDNS(ctx context.Context, cluster *kops.Cluster, cloud fi.Cloud) error {\n\t// TODO: Move to update\n\n\t// We precreate some DNS names (where they don't exist), with a dummy IP address\n\t// This avoids hitting negative TTL on DNS lookups, which tend to be very long","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/dns.go#L96-L132","documentation":"After a successful net.LookupNS, kOps checks that at least one NS record was returned for the cluster's zone. An empty result means the zone exists to the resolver but has no nameserver records, so kOps refuses to proceed because it cannot trust DNS records for the cluster will resolve. The check can be bypassed with DNS_IGNORE_NS_CHECK.","triggerScenarios":"net.LookupNS succeeds but returns zero NS records for the zone name — typically a newly created hosted zone before delegation, or a zone whose NS records were removed. Raised by `kops create cluster`/`kops update cluster` during validation.","commonSituations":"Route53/Cloud DNS/GCE zone created but registrar still points elsewhere with no NS records visible to the resolver; parent zone lacks glue/NS delegation; someone deleted the NS records; split-horizon setups where the internal resolver returns an empty answer.","solutions":["Ensure the zone has NS records and is delegated: dig NS <zone-name> against public resolvers","Update the registrar/parent zone to delegate to the hosted zone's nameservers","If the setup intentionally has no visible NS records (private/testing), set DNS_IGNORE_NS_CHECK=1 to bypass the check","Double-check the cluster name/zone matches a real configured zone"],"exampleFix":"// before\nkops create cluster --name cluster.example.com ...  # NS records not found\n// after\nexport DNS_IGNORE_NS_CHECK=1   # testing only\nkops create cluster --name cluster.example.com ...\n# production: properly delegate the zone instead","handlingStrategy":"validation","validationCode":"ns, _ := net.LookupNS(\"cluster.example.com\")\nif len(ns) == 0 {\n    return errors.New(\"zone has no NS records; delegate it at the registrar before running kops\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify delegation with dig NS against a public resolver (8.8.8.8)","Never delete NS records in a hosted zone","Use DNS_IGNORE_NS_CHECK=1 only for private/testing clusters","Match cluster name exactly to an existing configured zone"],"tags":["dns","configuration","validation"],"backgroundTag":"missing-ns-records","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}