Fix nameservers that do not answer for the domain

Why it matters

A server listed as authoritative for the domain does not actually serve its zone, so lookups sent to it fail or return nothing. Some visitors then see slow or failing lookups.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find the failing server with the command below. A healthy authoritative server returns the SOA record and sets the aa flag.
2. If the server should be serving your domain, configure the zone on it (or enable zone transfers from the primary) and reload it.
3. If it should not be in the list any more, remove it from the delegation at your registrar and keep at least two working nameservers.
4. Make changes one nameserver at a time, and re-check that the remaining servers answer before you remove more.

# replace ns1.example.net with a nameserver from the delegation
dig +norec @ns1.example.net SOA example.com

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Nameservers and delegation check
• Delegate the domain to working nameservers
• Add a second nameserver
• Spread nameservers across more than one network
• Make unreachable nameservers answer, or remove them
• Give each nameserver name an IP address
• Point nameserver names at public IP addresses
• Point nameserver names at A or AAAA records, not CNAMEs
• Make the registrar's nameservers match the zone's NS records
• Make all nameservers publish the same NS records
• Add glue records for nameservers inside your own domain
• Update glue records to match the nameserver's real address
• Check that nameservers are in sync