kubernetes/kops · error

NS records not found for %q - please make sure they are corr

Error message

NS records not found for %q - please make sure they are correctly configured

What it means

After a successful net.LookupNS, kOps checks that at least one NS record was returned for the cluster's zone. An empty result means the zone exists to the resolver but has no nameserver records, so kOps refuses to proceed because it cannot trust DNS records for the cluster will resolve. The check can be bypassed with DNS_IGNORE_NS_CHECK.

Source

Thrown at upup/pkg/fi/cloudup/dns.go:114

	zone, err := findZone(cluster, cloud)
	if err != nil {
		return err
	}
	if zone == nil {
		return nil
	}
	dnsName := strings.TrimSuffix(zone.Name(), ".")

	klog.V(2).Infof("Doing DNS lookup to verify NS records for %q", dnsName)
	ns, err := net.LookupNS(dnsName)
	if err != nil {
		return fmt.Errorf("error doing DNS lookup for NS records for %q: %v", dnsName, err)
	}

	if len(ns) == 0 {
		if os.Getenv("DNS_IGNORE_NS_CHECK") == "" {
			return fmt.Errorf("NS records not found for %q - please make sure they are correctly configured", dnsName)
		}
		klog.Warningf("Ignoring failed NS record check because DNS_IGNORE_NS_CHECK is set")
	} else {
		var hosts []string
		for _, n := range ns {
			hosts = append(hosts, n.Host)
		}
		klog.V(2).Infof("Found NS records for %q: %v", dnsName, hosts)
	}

	return nil
}

func precreateDNS(ctx context.Context, cluster *kops.Cluster, cloud fi.Cloud) error {
	// TODO: Move to update

	// We precreate some DNS names (where they don't exist), with a dummy IP address
	// This avoids hitting negative TTL on DNS lookups, which tend to be very long

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the zone has NS records and is delegated: dig NS <zone-name> against public resolvers
2. Update the registrar/parent zone to delegate to the hosted zone's nameservers
3. If the setup intentionally has no visible NS records (private/testing), set DNS_IGNORE_NS_CHECK=1 to bypass the check
4. Double-check the cluster name/zone matches a real configured zone

Example fix

// before
kops create cluster --name cluster.example.com ...  # NS records not found
// after
export DNS_IGNORE_NS_CHECK=1   # testing only
kops create cluster --name cluster.example.com ...
# production: properly delegate the zone instead

ns, _ := net.LookupNS("cluster.example.com")
if len(ns) == 0 {
    return errors.New("zone has no NS records; delegate it at the registrar before running kops")
}

When it happens

Trigger: net.LookupNS succeeds but returns zero NS records for the zone name — typically a newly created hosted zone before delegation, or a zone whose NS records were removed. Raised by `kops create cluster`/`kops update cluster` during validation.

Common situations: Route53/Cloud DNS/GCE zone created but registrar still points elsewhere with no NS records visible to the resolver; parent zone lacks glue/NS delegation; someone deleted the NS records; split-horizon setups where the internal resolver returns an empty answer.

Related errors

• error populating configuration: %v
• DNS provider does not support zones
• no suitable zone found for %q
• error parsing %q: %v
• unknown DNS provider %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c6ecf0036584c7ee. Report an issue: GitHub.