[Pdns-users] auth pdnsutil check-zone SOA weirdness.

[Brian Candler]

On 01/07/2026 11:04, Frank Hauptle via Pdns-users wrote:
> To test I am using "pdnsutil check-zone example.com 
> <http://example.com/>" from the command line of the container and I am 
> getting this back.
>
> pdns at 833f0efd3662:/$ pdnsutil check-zone example.com <http://example.com/>
> [*Error] No NS record at zone apex in zone 'example.com 
> <http://example.com/>'*
> Checked 2 records of 'example.com <http://example.com/>', 1 errors, 0 
> warnings.
>
> but if I run dig on my test domain I get this back:
> dig +noall +answer +multiline example.com <http://example.com/> ANY 
> @192.168.0.42 <http://192.168.0.42/>
> example.com <http://example.com/>.            3600 IN SOA 
> ns.example2.com <http://ns.example2.com/>. hostmaster.example2.com 
> <http://hostmaster.example2.com/>. (
>                                 2026070101 ; serial
>                                 14400      ; refresh (4 hours)
>                                 3600       ; retry (1 hour)
>                                 604800     ; expire (1 week)
>                                 3600       ; minimum (1 hour)
>                                 )
> Before this the SOA was set to an invalid message which I fixed with 
> an entry in pdns.conf default-soa-content=
> with the text as appears in the dig above.
>
> but when I do a check-zone it still returns the error up the top.. 
> doing my head in.
>
> Can anyone give me any pointers please?

An NS record is not the same as a SOA record. As the error says: you 
need at least one NS record at the zone apex, in addition to the SOA record.

Aside: note that ANY queries are deprecated, and many nameservers will 
refuse to answer them.

https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/
https://blog.cloudflare.com/what-happened-next-the-deprecation-of-any/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.powerdns.com/pipermail/pdns-users/attachments/20260701/6af72087/attachment.htm>