DENIC: Inconsistent set of NS RRs


#1

Hi! Recently I tried to use Cloudflare for the first time. I created my private account and added my customer’s domain to it. All was fine, but I did not do the final step - domain’s nameservers were not replaced with the ones provided by CF.
Then I left my account and create CF account for customer, where I added the same domain. CF provided new set of nameservers but the old one is still alive. When I’m trying to put new CF’s nameservers to the domain, DENIC (domain is in the .de zone) says “Error 118 Inconsistent set of NS RRs (IP, NS host names)”: I’m trying to set hal.ns.cloudflare.com and vita.ns.cloudflare.com (new set), but DENIC says there are eva.ns.cloudflare.com and damon.ns.cloudflare.com (old set) already.
I removed the domain from my private CF account, but it did not help - eva and damon are there still.

The question is: how can I delete eva and damon to let hal and vita do the job?


#2

@zugaenge,

Apologize for the inconvenience. I believe this is due to an issue on our side with the IPv6 RR records for the nameservers. A fix is being vetted and we’ll push it as soon as we’re finished with that process.


#3

Hello,
i have the same problem as @zugaenge but with
ken.ns.cloudflare.com
tricia.ns.cloudflare.com

Is this the same issue? Two of my domains were possible to change the DNS but one is not possible.

This Test tells me the following:

Severity	Code	Message / Parameters
Error	118	Inconsistent set of NS RRs (IP, NS host names)
tricia.ns.cloudflare.com./2400:cb00:2049:1:0:0:adf5:3ae8
[rita.ns.cloudflare.com, ben.ns.cloudflare.com]
Error	118	Inconsistent set of NS RRs (IP, NS host names)
 tricia.ns.cloudflare.com./173.245.58.232
[rita.ns.cloudflare.com, ben.ns.cloudflare.com]
Error	118	Inconsistent set of NS RRs (IP, NS host names)
ken.ns.cloudflare.com./2400:cb00:2049:1:0:0:adf5:3b7f
[rita.ns.cloudflare.com, ben.ns.cloudflare.com]
Error	118	Inconsistent set of NS RRs (IP, NS host names)
ken.ns.cloudflare.com./173.245.59.127
[rita.ns.cloudflare.com, ben.ns.cloudflare.com]

Regards,
benzel


#4

Having the very same problem, when can we expect a solution?

ERROR: 53300102912 Nameserver error [ERROR: 118 Inconsistent set of NS RRs (IP\, NS host names) (sri.ns.cloudflare.com./173.245.59.234\, \[jack.ns.cloudflare.com\, kate.ns.cloudflare.com\])]
ERROR: 53300102912 Nameserver error [ERROR: 118 Inconsistent set of NS RRs (IP\, NS host names) (ruth.ns.cloudflare.com./2400:cb00:2049:1:0:0:adf5:3a8f\, \[jack.ns.cloudflare.com\, kate.ns.cloudflare.com\])]
ERROR: 53300102912 Nameserver error [ERROR: 118 Inconsistent set of NS RRs (IP\, NS host names) (ruth.ns.cloudflare.com./173.245.58.143\, \[jack.ns.cloudflare.com\, kate.ns.cloudflare.com\])]
ERROR: 53300102912 Nameserver error [ERROR: 118 Inconsistent set of NS RRs (IP\, NS host names) (sri.ns.cloudflare.com./2400:cb00:2049:1:0:0:adf5:3bea\, \[jack.ns.cloudflare.com\, kate.ns.cloudflare.com\])]

#5

Eventually, the issue has gone, and I have successfully set nameservers.
Do not know what exactly what did help, but my domain registrar told me to remove wildcard (*) domain from cloudflare and manually add all necessary subdomains.


#6

Hi,

I have the same problem as @zugaenge but with jake.ns.cloudflare.com and lily.ns.cloudflare.com

Is this the same issue? One of my domains were possible to change the DNS but one is not possible.

The DENIC NS Predelegation Check show me the following messages:

Severity	Code	Message / Parameters
Error	118	Inconsistent set of NS RRs (IP, NS host names)
jake.ns.cloudflare.com./2400:cb00:2049:1:0:0:adf5:3b7a
[nitin.ns.cloudflare.com, mary.ns.cloudflare.com]
Error	118	Inconsistent set of NS RRs (IP, NS host names)
jake.ns.cloudflare.com./173.245.59.122
[nitin.ns.cloudflare.com, mary.ns.cloudflare.com]
Error	118	Inconsistent set of NS RRs (IP, NS host names)
lily.ns.cloudflare.com./173.245.58.130
[nitin.ns.cloudflare.com, mary.ns.cloudflare.com]
Error	118	Inconsistent set of NS RRs (IP, NS host names)
lily.ns.cloudflare.com./2400:cb00:2049:1:0:0:adf5:3a82
[nitin.ns.cloudflare.com, mary.ns.cloudflare.com]

Best Regards,
Richard


#7

This is usually due to the domain in question (zone) already being signed up on Cloudflare (active or pending).

What’s happening is that Cloudflare responds with the nameservers (NS) for the zone that is either currently active or first signed up. As DENIC is strict, when you try to set your assigned nameservers they believe the wrong NS are responding thus they prevent you from setting these nameservers. In reality all Cloudflare nameservers respond to all Cloudflare zones so if they would actually allow you to change nameservers then all would be fine.

Note: if you control the previous zone sign up, simply delete it and then let Cloudflare Support know that you have a strict registrar and need them to purge the previous zone. Otherwise you can wait (about two weeks) for the other zone to be purged automatically.

To check what Cloudflare NS are assigned for the domain in question (you can query any CF NS like Jake):

$ dig ns @jake.ns.cloudflare.com example.com
...
;; ANSWER SECTION:
example.com.		86400	IN	NS	bill.ns.cloudflare.com.
example.com.		86400	IN	NS	lily.ns.cloudflare.com.

If the above check comes back with nameservers that aren’t assigned to your account you can be fairly confident that your zone has already been signed up (and it may be active or pending). This is not an issue if you could actually change your nameservers without the registrar complaining as eventually any other zones would be pushed aside as your domain activates.

If the above command comes back with your account’s assigned nameservers then you are all set and should be good to set your nameservers at your registrar.

There are a couple solutions here if your registrar puts you in this situation:

  1. You can wait and if the other zone doesn’t activate (e.g. they don’t change NS to their assigned nameservers) then Cloudflare will eventually remove the zone in the way and start responding for your zone. This can take some time however (multiple weeks from when the zone in the way was signed up, not your zone).

  2. You can contact Cloudflare Support and tell them you are using a registrar which is strict and therefore you need them to confirm you are indeed the zone owner (through a TXT record set at your authoritative DNS). Once Support verifies ownership they can change your zone to be the one Cloudflare responds to. If you don’t set the TXT record they provide, they won’t make that change so do make sure to set the TXT record appropriately.

Lastly, remember that there are millions of zones on Cloudflare and ultimately they respond DNS wise to whomever signs up the domain first (that is not the same as activation). As such strict registrars put their customers into a tricky situation as they think they are protecting you when in fact they are hampering your sign up process with Cloudflare.