I'm currently in the process of moving all of our domains to our own nameservers. Which wasn't an issue until I hit our own .de domain. I (think I) understand the implications of having the NS inside it's own domain, hence the need for glue records.

Until yesterday, I would have assumed I have a pretty good understanding of Bind and DNS zones until I was presented with this error from the Denic nameserver predelegation check:

Inconsistent set of nameserver IP addresses (NS, provided glues, determined glues)

  • ns2.hartwig-at.de
  • []
  • Default resolver determined: [], other resolvers determined: {[/2a01:4f8:d13:3c85:0:0:0:2, /]}

Inconsistent set of nameserver IP addresses (NS, provided glues, determined glues)

  • ns1.hartwig-at.de
  • [cloud.hartwig-at.de/]
  • Default resolver determined: [], other resolvers determined: {cloud.hartwig-at.de/[/2a00:1158:3:0:0:0:0:b6, /]}

Screenshot of the result

The support of my registrar is either far better educated than me or doesn't have a clue. Either way, they're avoiding my questions in regards to what this error means. They just tell me

Your nameserver has to return your own nameservers as the default resolver.

But that doesn't make any sense to me and they refuse to try to explain it any other way.

This is the head of my current zone file:

@               86400   IN SOA          ns1.hartwig-at.de. hostmaster.hartwig-at.de. (
                                        2012070505 ; serial
                                        1d         ; refresh
                                        3h         ; retry
                                        4w         ; expiry
                                        1h )       ; minimum

                3600    IN NS           ns1.hartwig-at.de.
                3600    IN NS           ns2.hartwig-at.de.

                3600    IN MX 10        remote.hartwig-at.de.
                3600    IN MX 20        mx1.hartwig-at.de.
                3600    IN MX 30        mx2.hartwig-at.de.

localhost       3600    IN A  
localhost       3600    IN AAAA         ::1
@               3600    IN A  
                3600    IN AAAA         2a00:1158:3::b6
*               3600    IN A  
                3600    IN AAAA         2a00:1158:3::b6

hetzner         3600    IN A  
hetzner         3600    IN AAAA         2a01:4f8:d13:3c85::2
cloud           3600    IN A  
cloud           3600    IN AAAA         2a00:1158:3::b6

; List all NS as A/AAAA record
ns              3600    IN A  
ns              3600    IN AAAA         2a00:1158:3::b6
ns1             3600    IN A  
ns1             3600    IN AAAA         2a00:1158:3::b6
ns2             3600    IN A  
ns2             3600    IN AAAA         2a01:4f8:d13:3c85::2

So, what is the problem with my zone? And what is the "default resolver"?


Your nameservers have AAAA records, but you didn't include the IPv6 addresses as glue records (hence the glue records are not consistent with the addresses returned by your nameserver). Running the check with both IPv4 and IPv6 addresses listed returns the following:

DEnic nameserver check

| improve this answer | |
  • Now that's a load off my mind. Thanks a lot! The registrar does not support IPv6 glue records :( Should I drop the IPv6 addresses for my NS from my zone to make it comply again? – Der Hochstapler Jul 5 '12 at 20:57
  • @OliverSalzburg If the check doesn't actually get enforced by the registrar you can leave the AAAA records, but you won't have IPv6-only DNS working if you can't have AAAA glue records. – mgorven Jul 5 '12 at 21:01
  • I know, it sucks :( Let me update my zone and give it another go. Thanks again – Der Hochstapler Jul 5 '12 at 21:02

Shouldn't your SOA record look something like

hartwig-at.de.   IN SOA          ns1.hartwig-at.de. hostmaster.hartwig-at.de. ...
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.