kubernetes/kops · error

cannot find DNS Zone %q. Please pre-create the zone and set

Error message

cannot find DNS Zone %q.  Please pre-create the zone and set up NS records so that it resolves

What it means

findZone matches zones by ID or name (trailing dot trimmed) against cluster.Spec.DNSZone. If no provider zone matches, kOps throws this error because the cluster's DNS records cannot be hosted. DNS zones must be pre-created and delegated (NS records) before cluster creation/validation can proceed.

Source

Thrown at upup/pkg/fi/cloudup/dns.go:75

		return nil, fmt.Errorf("error getting DNS zones provider")
	}

	zones, err := zonesProvider.List()
	if err != nil {
		return nil, fmt.Errorf("error listing DNS zones: %v", err)
	}

	var matches []dnsprovider.Zone
	findName := strings.TrimSuffix(cluster.Spec.DNSZone, ".")
	for _, zone := range zones {
		id := zone.ID()
		name := strings.TrimSuffix(zone.Name(), ".")
		if id == cluster.Spec.DNSZone || name == findName {
			matches = append(matches, zone)
		}
	}
	if len(matches) == 0 {
		return nil, fmt.Errorf("cannot find DNS Zone %q.  Please pre-create the zone and set up NS records so that it resolves", cluster.Spec.DNSZone)
	}

	if len(matches) > 1 {
		klog.Infof("Found multiple DNS Zones matching %q, please set the cluster's spec.dnsZone to the desired Zone ID:", cluster.Spec.DNSZone)
		for _, zone := range zones {
			id := zone.ID()
			klog.Infof("\t%s", id)
		}
		return nil, fmt.Errorf("found multiple DNS Zones matching %q", cluster.Spec.DNSZone)
	}

	zone := matches[0]
	return zone, nil
}

func validateDNS(cluster *kops.Cluster, cloud fi.Cloud) error {
	if !cluster.PublishesDNSRecords() || cluster.UsesPrivateDNS() {
		klog.V(2).Infof("Skipping DNS validation for non-public DNS")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Pre-create the DNS zone (e.g. `aws route53 create-hosted-zone --name example.com ...` or via cloud console)
2. Set spec.dnsZone (or --dns-zone) to the exact zone name or ID that exists in the account your credentials point to
3. Confirm NS records delegate the zone so it resolves publicly
4. Verify you are authenticated to the account that actually hosts the zone

Example fix

// before
kops create cluster --dns-zone clusters.nonexistent.example ...
// after
aws route53 create-hosted-zone --name clusters.example.com --caller-reference 1
kops create cluster --dns-zone clusters.example.com ...

// Ensure zone exists and is resolvable before kops create
if _, err := net.LookupNS(cluster.Spec.DNSZone); err != nil {
    return fmt.Errorf("zone %s not resolvable: pre-create it and set NS records", cluster.Spec.DNSZone)
}

if _, err := findZone(cluster, cloud); err != nil {
    if strings.Contains(err.Error(), "cannot find DNS Zone") {
        return precreateZoneAndNSRecords(cluster.Spec.DNSZone)
    }
    return err
}

When it happens

Trigger: validateDNS or precreateDNS with spec.dnsZone set to a zone that does not exist in the DNS account — typo in zone name, zone in a different AWS account/region-agnostic account, or zone simply never created.

Common situations: Forgetting to pre-create a Route53/Cloud DNS/Azure DNS public zone; zone exists in another cloud account/subscription than the credentials in use; using the DNS name instead of zone ID where matching failed due to delegation issues.

Related errors

• found multiple hosted zones matched name %q
• DNS provider does not support zones
• error applying DNS changeset for zone %s: %v
• no suitable zone found for %q
• error parsing %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3fe90951f6bf0493. Report an issue: GitHub.