diff --git a/pkg/services/meshdns/default_handler.go b/pkg/services/meshdns/default_handler.go
index 38a3961c1..6f7f3b088 100644
--- a/pkg/services/meshdns/default_handler.go
+++ b/pkg/services/meshdns/default_handler.go
@@ -30,6 +30,7 @@ func (s *Server) handleDefault(ctx context.Context, w dns.ResponseWriter, r *dns
 		s.log.Debug("handling root NS request")
 		// newMsg automatically adds the NS records for the root zone
 		m := s.newMsg(r)
+		m.Answer = append(m.Answer, s.newNSRecord())
 		s.writeMsg(w, r, m, dns.RcodeSuccess)
 		return
 	}
diff --git a/pkg/services/meshdns/server_util.go b/pkg/services/meshdns/server_util.go
index cfbfe7eaa..94f36a4eb 100644
--- a/pkg/services/meshdns/server_util.go
+++ b/pkg/services/meshdns/server_util.go
@@ -66,6 +66,19 @@ func (s *Server) newFQDN(id string) string {
 	return fmt.Sprintf("%s.%s", id, s.store.Domain())
 }
 
+func (s *Server) newNSRecord() dns.RR {
+	return &dns.NS{
+		Hdr: dns.RR_Header{
+			Name:     s.store.Domain(),
+			Rrtype:   dns.TypeNS,
+			Class:    dns.ClassINET,
+			Ttl:      1,
+			Rdlength: 0,
+		},
+		Ns: fmt.Sprintf("%s.%s", s.store.ID(), s.store.Domain()),
+	}
+}
+
 func (s *Server) newMsg(r *dns.Msg) *dns.Msg {
 	m := new(dns.Msg)
 	m.SetReply(r)
@@ -73,10 +86,7 @@ func (s *Server) newMsg(r *dns.Msg) *dns.Msg {
 	m.Authoritative = true
 	m.RecursionAvailable = true
 	// m.Response = true
-	m.Ns = []dns.RR{&dns.SOA{
-		Hdr: dns.RR_Header{Name: s.store.Domain(), Rrtype: dns.TypeSOA, Class: dns.ClassINET, Ttl: 1},
-		Ns:  fmt.Sprintf("%s.%s", s.store.ID(), s.store.Domain()),
-	}}
+	m.Ns = []dns.RR{s.newNSRecord()}
 	return m
 }