dnscontrol icon indicating copy to clipboard operation
dnscontrol copied to clipboard

Azure DNS - Add additional nameserver to zone returns error about multiple entries

Open fabienmazieres opened this issue 1 year ago • 7 comments

Describe the bug

Adding nameserver entries to Azure public DNS zone fails to add the additionnal server, it returns error message "The list of record sets of type 'NS' may not contain multiple entries with the same 'nsdname'". I want to add extra name server as I intend to host this zone on 2 providers.

To Reproduce

I use the following dnsconfig.js:

var REG_NONE = NewRegistrar("none");
var DNS_AZURE = NewDnsProvider("azuredns_main");

D("example.co.uk", REG_NONE, DnsProvider(DNS_AZURE),
    // Top-level domain configuration
    NAMESERVER_TTL("172800"), // 2 days

    // Azure DNS name servers
    NAMESERVER("ns1-01.azure-dns.com."),
    NAMESERVER("ns2-01.azure-dns.net."),
    NAMESERVER("ns3-01.azure-dns.org."),
    NAMESERVER("ns4-01.azure-dns.info."),

    // Other provider
    NAMESERVER("ns1.other.provider.net."),

    // Records
    A("test", "1.2.3.4"),
    END);

when using preview, it calculate the changes as expected:

PS C:\Users\DNSasCode> dnscontrol preview
******************** Domain: example.co.uk
1 correction (azuredns_main)
#1: + CREATE example.co.uk NS ns1.other.provider.net. ttl=172800
Done. 1 corrections.

but push returns an error message

PS C:\Users\N18180\source\PlatformEngineering.DNSasCode> dnscontrol push   
******************** Domain: impersotech.co.uk
2 corrections (azuredns_main)
#1: + CREATE example.co.uk NS ns1.other.provider.net ttl=172800
FAILURE! PUT https://management.azure.com/subscriptions/xxx-yyy/resourceGroups/xxx/providers/Microsoft.Network/dnsZones/example.co.uk/NS/@
--------------------------------------------------------------------------------
RESPONSE 400: 400 Bad Request
ERROR CODE: BadRequest
--------------------------------------------------------------------------------
{
  "code": "BadRequest",
  "message": "The list of record sets of type 'NS' may not contain multiple entries with the same 'nsdname'."
}
--------------------------------------------------------------------------------
[...]

Adding the extra providers in Azure Portal manually works and subsequent preview or push do validate the change was done as expected.

Expected behavior

No error message displayed, additional NS servers added to the @ NS record.

DNS Provider Azure DNS (azuredns_main)

fabienmazieres avatar Aug 19 '24 16:08 fabienmazieres

CC @vatsalyagoel

tlimoncelli avatar Aug 19 '24 19:08 tlimoncelli

Looking into the issue

vatsalyagoel avatar Aug 27 '24 02:08 vatsalyagoel

@fabienmazieres When adding additional NAMESERVER Records, you don't need to specify the Azure records on the domain.

NAMESERVER("ns1-01.azure-dns.com."), NAMESERVER("ns2-01.azure-dns.net."), NAMESERVER("ns3-01.azure-dns.org."), NAMESERVER("ns4-01.azure-dns.info.")

These will automatically be there when DNSControl gets the zone from AzureDNS

vatsalyagoel avatar Sep 11 '24 15:09 vatsalyagoel

@vatsalyagoel , I will have to support 2 providers, Azure and Oracle, hence why I had put the azure records in the config. I could omit those and rely on the registrar data but I thought it would be best to be explicit in my config.

All that said, the issue still occurs to me and I am not sure how to take it. If you have some pointer where I should look into I would be happy to also help dig a bit and see if I can find anything.

fabienmazieres avatar Sep 16 '24 08:09 fabienmazieres

Each provider handles Domain Delegation a little differently and sometimes they conflict. Often the best way to resolve this is to manually set the delegation via the provider's website.

This doc might be helpful, especially the last section where it explains that behavior is different if there are zero NAMESERVER() statements in a zone.

tlimoncelli avatar Sep 16 '24 13:09 tlimoncelli

@tlimoncelli maybe I should add a PR to de duplicate NS/Nameserver records if we detect that there are any. But I don't know if it would go against the design. If you give your blessing, I'll create the PR

vatsalyagoel avatar Oct 07 '24 16:10 vatsalyagoel

@tlimoncelli maybe I should add a PR to de duplicate NS/Nameserver records if we detect that there are any. But I don't know if it would go against the design. If you give your blessing, I'll create the PR

Yes, please. (Now that Go has generics, you might find https://pkg.go.dev/slices useful)

tlimoncelli avatar Oct 09 '24 17:10 tlimoncelli

@vatsalyagoel and @tlimoncelli , this issue still persist, should I try to create a fix for that or you guys are still working on that? Please let me know if you need help with that so I can fix it.

lckz avatar Apr 08 '25 11:04 lckz

Hey @lckz , yes, please! Would love a PR from ya.

tlimoncelli avatar Apr 08 '25 14:04 tlimoncelli

Added a PR fix to the issue

vatsalyagoel avatar Apr 16 '25 01:04 vatsalyagoel