zone example.com/IN: NS 'ns1.example.com' has no address records (A or AAAA)
The zone lists a name server inside itself but never gives that server an A or AAAA record, so nobody could find it. BIND refuses to load the zone rather than serve a delegation that cannot work. Frequent causes are a typo in the glue name, a missing trailing dot that turned ns1.example.com. into ns1.example.com.example.com, or deleting the old server's address record before the NS record.
Quick fix
Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.
# Run the same check BIND runs at load time
named-checkzone example.com /etc/bind/db.example.com
# Look at the NS lines and the matching address records
grep -nE '\sNS\s|^ns1' /etc/bind/db.example.com
# Missing trailing dot? These two lines mean different things:
# @ IN NS ns1.example.com. (absolute, correct)
# @ IN NS ns1.example.com (becomes ns1.example.com.example.com.)
# Add the address and bump the SOA serial, then reload
# ns1 IN A 203.0.113.10
named-checkzone example.com /etc/bind/db.example.com && sudo rndc reload example.comHow to diagnose DNS errors
DNS errors are best diagnosed by working down the delegation chain: root, TLD, authoritative nameserver, then the record itself. The most common mistake is testing only through your local resolver, which caches both good and bad answers and hides where the failure actually is. NXDOMAIN means the name definitively does not exist; SERVFAIL means the resolver could not get a valid answer, which is usually a DNSSEC or authoritative-server problem, not a typo.
If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.
- Query the authoritative nameserver directly, bypassing all caches:
dig @ns1.example.com example.com A. If that answers correctly, you have a caching or propagation issue, not a records issue. - Trace the full delegation with
dig +trace example.com. This shows exactly which level of the hierarchy stops returning answers. - Distinguish NXDOMAIN from SERVFAIL from timeout. They have three entirely different causes. Check the
status:line in dig output. - For SERVFAIL, test with DNSSEC validation disabled:
dig +cd example.com. If that succeeds, the problem is a broken DNSSEC chain, often after a key rollover. - Check TTLs before declaring propagation broken. A record with a 24-hour TTL genuinely will not update for resolvers that cached it, and there is no way to force them.
Tools worth reaching for
dig +tracedig @authoritative-nsdig +cd (DNSSEC bypass)kdigresolvectl status
Authoritative references
Primary documentation for this error, worth reading before applying any fix in production.
Related DNS errors
- Bad Gateway - DNS resolutionReverse proxy cannot resolve the upstream server's hostname to an IP address.
- dig: ;; Truncated, retrying in TCP modeThe answer did not fit in the UDP message size the client offered, so the server set the TC…
- dig: status: SERVFAIL with EDE: 6 (DNSSEC Bogus)The resolver fetched the answer but its DNSSEC signatures did not validate, so it refused to…
- DNS cache poisoning detectedDNS resolver returned suspicious results, possibly indicating cache poisoning attack.
- DNS lookup timeoutDNS query took too long to complete, often due to slow or unresponsive DNS servers.
- DNS NXDOMAINDomain name does not exist in DNS, the queried domain is not registered or configured.
- DNS problem: NXDOMAIN looking up TXT for _acme-challenge.example.comLet's Encrypt queried the authoritative servers for the DNS-01 challenge record and was told…
- DNS resolution failedThe domain name could not be resolved to an IP address. DNS server may be unreachable or the…
Browse other categories
- HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
- JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
- Database 41Connections, deadlocks, constraints, replication and memory limits.
- AI 35Rate limits, context windows, GPU memory and model-serving failures.
- Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
- Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
- Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
- Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
- System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
- Cloud 25IAM permissions, quotas, service limits and credential failures.
- Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
- TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
Something missing or wrong?
This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.