Re: auth pdnsutil check-zone SOA weirdness.
Brian Candler via Pdns-users <[email protected]> Wed, 1 Jul 2026 11:21:44 +0100
| Newsgroups | gmane.network.dns.powerdns.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============8701172920202608792==
Content-Type: multipart/alternative;
boundary="------------N9p5Krsa0QryOhDwtW8i07Sd"
Content-Language: en-GB
This is a multi-part message in MIME format.
--------------N9p5Krsa0QryOhDwtW8i07Sd
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
On 01/07/2026 11:04, Frank Hauptle via Pdns-users wrote:
> To test I am using "pdnsutil check-zone example.com
> <http://example.com/>" from the command line of the container and I am
> getting this back.
>
> pdns@833f0efd3662:/$ pdnsutil check-zone example.com <http://example.com/>
> [*Error] No NS record at zone apex in zone 'example.com
> <http://example.com/>'*
> Checked 2 records of 'example.com <http://example.com/>', 1 errors, 0
> warnings.
>
> but if I run dig on my test domain I get this back:
> dig +noall +answer +multiline example.com <http://example.com/> ANY
> @192.168.0.42 <http://192.168.0.42/>
> example.com <http://example.com/>. 3600 IN SOA
> ns.example2.com <http://ns.example2.com/>. hostmaster.example2.com
> <http://hostmaster.example2.com/>. (
> 2026070101 ; serial
> 14400 ; refresh (4 hours)
> 3600 ; retry (1 hour)
> 604800 ; expire (1 week)
> 3600 ; minimum (1 hour)
> )
> Before this the SOA was set to an invalid message which I fixed with
> an entry in pdns.conf default-soa-content=
> with the text as appears in the dig above.
>
> but when I do a check-zone it still returns the error up the top..
> doing my head in.
>
> Can anyone give me any pointers please?
An NS record is not the same as a SOA record. As the error says: you
need at least one NS record at the zone apex, in addition to the SOA record.
Aside: note that ANY queries are deprecated, and many nameservers will
refuse to answer them.
https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/
https://blog.cloudflare.com/what-happened-next-the-deprecation-of-any/
--------------N9p5Krsa0QryOhDwtW8i07Sd
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 01/07/2026 11:04, Frank Hauptle via
Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CABLMkgQ1rGACRNLn6dTsAdms3vjYxiP5ArB+2qfw5HJ-XSBaAQ@mail.gmail.com">
<div>To test I am using "pdnsutil check-zone <a
href="http://example.com/" target="_blank"
moz-do-not-send="true">example.com</a>" from the command line
of the container and I am getting this back.</div>
<div><br>
</div>
<div>pdns@833f0efd3662:/$ pdnsutil check-zone <a
href="http://example.com/" target="_blank"
moz-do-not-send="true">example.com</a><br>
[<b>Error] No NS record at zone apex in zone '<a
href="http://example.com/" target="_blank"
moz-do-not-send="true">example.com</a>'</b><br>
Checked 2 records of '<a href="http://example.com/"
target="_blank" moz-do-not-send="true">example.com</a>', 1
errors, 0 warnings.</div>
<div><br>
</div>
<div>but if I run dig on my test domain I get this back:</div>
<div>dig +noall +answer +multiline <a href="http://example.com/"
target="_blank" moz-do-not-send="true">example.com</a> ANY @<a
href="http://192.168.0.42/" target="_blank"
moz-do-not-send="true">192.168.0.42</a><br>
<a href="http://example.com/" target="_blank"
moz-do-not-send="true">example.com</a>. 3600 IN
SOA <a href="http://ns.example2.com/" target="_blank"
moz-do-not-send="true">ns.example2.com</a>. <a
href="http://hostmaster.example2.com/" target="_blank"
moz-do-not-send="true">hostmaster.example2.com</a>. (<br>
2026070101 ; serial<br>
14400 ; refresh (4 hours)<br>
3600 ; retry (1 hour)<br>
604800 ; expire (1 week)<br>
3600 ; minimum (1 hour)<br>
)<br>
</div>
<div>Before this the SOA was set to an invalid message which I
fixed with an entry in pdns.conf default-soa-content= </div>
<div>with the text as appears in the dig above.</div>
<div><br>
</div>
<div>but when I do a check-zone it still returns the error up the
top.. doing my head in.</div>
<div><br>
</div>
<div>Can anyone give me any pointers please?</div>
</blockquote>
<p>An NS record is not the same as a SOA record. As the error says:
you need at least one NS record at the zone apex, in addition to
the SOA record.</p>
<p>Aside: note that ANY queries are deprecated, and many nameservers
will refuse to answer them. </p>
<p><a class="moz-txt-link-freetext" href="https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/">https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/</a><br>
<a class="moz-txt-link-freetext" href="https://blog.cloudflare.com/what-happened-next-the-deprecation-of-any/">https://blog.cloudflare.com/what-happened-next-the-deprecation-of-any/</a></p>
</body>
</html>
--------------N9p5Krsa0QryOhDwtW8i07Sd--
--===============8701172920202608792==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Pdns-users mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-users
--===============8701172920202608792==--