Nameserver reachability: responding, TCP and public addresses
For your domain to resolve reliably, every nameserver in your delegation has to be reachable and well-behaved: answer quickly over both UDP and TCP, sit on a public address, and hand out the zone only to your own secondaries.
All nameservers respond
Resolvers pick a nameserver more or less at random. If one is down or silent, some lookups are slow or fail while others work, so the domain seems flaky. The report queries every listed nameserver; one that does not answer over UDP is an error.
TCP connections allowed
DNS uses UDP for most queries but must fall back to TCP for large answers (DNSSEC, big record sets) and for zone transfers. A nameserver, or a firewall in front of it, that blocks TCP port 53 will fail those larger queries in ways that are hard to diagnose. The report opens a TCP connection to each nameserver; one that refuses is a warning.
Public addresses
A nameserver has to be reachable from the whole internet, so its address must be globally routable - not a private (RFC 1918), loopback, or link-local address. A private IP in your delegation means outside resolvers cannot reach that server at all. The report flags any nameserver whose address is not public.
Zone transfers refused
A zone transfer (AXFR) hands over every record in your zone. It should be allowed only to your designated secondary nameservers, never to the public, since it is a reconnaissance gift. The report attempts an AXFR from each nameserver; one that serves it is an error, and a nameserver that refuses, resets, or drops the connection is the desired result.
How to fix it
- Not responding: confirm the server is up and that UDP/TCP port 53 is open in its firewall and any network ACL; make sure the delegation does not list a decommissioned server.
- No TCP: allow inbound TCP on port 53 as well as UDP.
- Private address: publish only public IPs in your delegation and glue; move internal-only nameservers out of the public NS set.
- Open AXFR: restrict transfers (BIND:
allow-transfer { your-secondaries; };).
How to verify
dig @ns1.example.com example.com SOA +norecurse # UDP, expect an authoritative answer
dig @ns1.example.com example.com SOA +tcp +norecurse # TCP works too
dig @ns1.example.com example.com AXFR # should be refused