<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 01/07/2026 11:04, Frank Hauptle via
Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CABLMkgQ1rGACRNLn6dTsAdms3vjYxiP5ArB+2qfw5HJ-XSBaAQ@mail.gmail.com">
<div>To test I am using "pdnsutil check-zone <a
href="http://example.com/" target="_blank"
moz-do-not-send="true">example.com</a>" from the command line
of the container and I am getting this back.</div>
<div><br>
</div>
<div>pdns@833f0efd3662:/$ pdnsutil check-zone <a
href="http://example.com/" target="_blank"
moz-do-not-send="true">example.com</a><br>
[<b>Error] No NS record at zone apex in zone '<a
href="http://example.com/" target="_blank"
moz-do-not-send="true">example.com</a>'</b><br>
Checked 2 records of '<a href="http://example.com/"
target="_blank" moz-do-not-send="true">example.com</a>', 1
errors, 0 warnings.</div>
<div><br>
</div>
<div>but if I run dig on my test domain I get this back:</div>
<div>dig +noall +answer +multiline <a href="http://example.com/"
target="_blank" moz-do-not-send="true">example.com</a> ANY @<a
href="http://192.168.0.42/" target="_blank"
moz-do-not-send="true">192.168.0.42</a><br>
<a href="http://example.com/" target="_blank"
moz-do-not-send="true">example.com</a>. 3600 IN
SOA <a href="http://ns.example2.com/" target="_blank"
moz-do-not-send="true">ns.example2.com</a>. <a
href="http://hostmaster.example2.com/" target="_blank"
moz-do-not-send="true">hostmaster.example2.com</a>. (<br>
2026070101 ; serial<br>
14400 ; refresh (4 hours)<br>
3600 ; retry (1 hour)<br>
604800 ; expire (1 week)<br>
3600 ; minimum (1 hour)<br>
)<br>
</div>
<div>Before this the SOA was set to an invalid message which I
fixed with an entry in pdns.conf default-soa-content= </div>
<div>with the text as appears in the dig above.</div>
<div><br>
</div>
<div>but when I do a check-zone it still returns the error up the
top.. doing my head in.</div>
<div><br>
</div>
<div>Can anyone give me any pointers please?</div>
</blockquote>
<p>An NS record is not the same as a SOA record. As the error says:
you need at least one NS record at the zone apex, in addition to
the SOA record.</p>
<p>Aside: note that ANY queries are deprecated, and many nameservers
will refuse to answer them. </p>
<p><a class="moz-txt-link-freetext" href="https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/">https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/</a><br>
<a class="moz-txt-link-freetext" href="https://blog.cloudflare.com/what-happened-next-the-deprecation-of-any/">https://blog.cloudflare.com/what-happened-next-the-deprecation-of-any/</a></p>
</body>
</html>