kubernetes/kops · error

error doing DNS lookup for NS records for %q: %v

Error message

error doing DNS lookup for NS records for %q: %v

What it means

During cluster validation, kOps verifies that the DNS zone backing the cluster's domain actually has NS records by performing a Go net.LookupNS on the zone name. If the resolver returns an error (network failure, missing zone, DNS outage), validateDNS wraps it in this message. It aborts cluster creation/update because kOps cannot confirm the zone will resolve.

Source

Thrown at upup/pkg/fi/cloudup/dns.go:109

func validateDNS(cluster *kops.Cluster, cloud fi.Cloud) error {
	if !cluster.PublishesDNSRecords() || cluster.UsesPrivateDNS() {
		klog.V(2).Infof("Skipping DNS validation for non-public DNS")
		return nil
	}

	zone, err := findZone(cluster, cloud)
	if err != nil {
		return err
	}
	if zone == nil {
		return nil
	}
	dnsName := strings.TrimSuffix(zone.Name(), ".")

	klog.V(2).Infof("Doing DNS lookup to verify NS records for %q", dnsName)
	ns, err := net.LookupNS(dnsName)
	if err != nil {
		return fmt.Errorf("error doing DNS lookup for NS records for %q: %v", dnsName, err)
	}

	if len(ns) == 0 {
		if os.Getenv("DNS_IGNORE_NS_CHECK") == "" {
			return fmt.Errorf("NS records not found for %q - please make sure they are correctly configured", dnsName)
		}
		klog.Warningf("Ignoring failed NS record check because DNS_IGNORE_NS_CHECK is set")
	} else {
		var hosts []string
		for _, n := range ns {
			hosts = append(hosts, n.Host)
		}
		klog.V(2).Infof("Found NS records for %q: %v", dnsName, hosts)
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. dig NS <zone-name> to confirm NS records resolve publicly; if not, fix delegation at the registrar/parent zone
2. Verify the hosted zone exists in the cloud DNS provider and that kOps targets the right zone (--dns-zone / DNS zone config)
3. Wait for delegation propagation (usually minutes, up to 48h for new zones) and retry
4. Check local resolver/firewall allows outbound DNS; try another resolver with dig @8.8.8.8

Example fix

// before
export KOPS_STATE_STORE=s3://bucket
kops create cluster --name cluster.example.com --zones us-east-1a
# fails: NS lookup fails because zone not delegated
// after
# create hosted zone, update registrar NS records first:
aws route53 create-hosted-zone --name cluster.example.com ...
# set NS records at registrar, verify, then rerun kops create cluster

if _, err := net.LookupNS("cluster.example.com"); err != nil {
    return fmt.Errorf("pre-flight: NS lookup for cluster zone failed: %w", err)
}

ns, err := net.LookupNS(zone)
if err != nil {
    return fmt.Errorf("DNS zone not resolvable (%v); fix delegation or set DNS_IGNORE_NS_CHECK for testing", err)
}

When it happens

Trigger: Running `kops create cluster`/`kops update cluster` when the zone's DNS is unresolvable: the hosted zone does not exist yet, nameservers are not delegated, the local resolver cannot reach authoritative servers, or the DNS provider API is healthy but the zone name is wrong (e.g. wrong suffix in --dns-zone).

Common situations: User created the hosted zone seconds earlier and delegation hasn't propagated; private zone with a resolver that can't see it; typo in domain; corporate firewall blocks outbound DNS on UDP/TCP 53; SOA exists but NS records were accidentally deleted.

Understand the failure class

• DNS resolution errors: ENOTFOUND and getaddrinfo failures — how hostname lookups fail and how to debug them.

Related errors

• unable to resolve Kubernetes cluster API URL dns: %v
• error querying for DNS zones: %v
• linode VPC requires at least one subnet
• error parsing network cidr %q: %v
• error parsing CIDR %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7f9c46d57b5fd251. Report an issue: GitHub.