Make unreachable nameservers answer, or remove them

Why it matters

A nameserver in the delegation does not answer queries at all, so lookups that reach it wait and then fail over to another server. That slows the site and leaves you without redundancy.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Check that the DNS service is running on the server and listens on port 53 for both UDP and TCP.
2. Check the firewall and network rules, including cloud security groups. Both UDP and TCP port 53 must be open to the whole internet, not only to your own addresses.
3. If the server has been retired, remove it from the delegation at your registrar and keep at least two working nameservers.
4. Confirm with the command below, once over UDP and once over TCP.

# replace ns1.example.net with a nameserver from the delegation
dig +norec @ns1.example.net SOA example.com
dig +norec +tcp @ns1.example.net SOA example.com

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Nameservers and delegation check
• Delegate the domain to working nameservers
• Add a second nameserver
• Spread nameservers across more than one network
• Fix nameservers that do not answer for the domain
• Give each nameserver name an IP address
• Point nameserver names at public IP addresses
• Point nameserver names at A or AAAA records, not CNAMEs
• Make the registrar's nameservers match the zone's NS records
• Make all nameservers publish the same NS records
• Add glue records for nameservers inside your own domain
• Update glue records to match the nameserver's real address
• Check that nameservers are in sync