RCODE

Stands for: Response Code

The status code in every DNS response, such as NOERROR (0), SERVFAIL (2), NXDOMAIN (3) or REFUSED (5).

dig prints it as status on its HEADER line, and nslookup as the reason it can't find a name. It is the first thing to read in a failed lookup, because each value points at a different culprit: the name itself, the server that answered, or a policy that turned the question away.

RFC 1035 defined six values in 1987: 0 no error, 1 format error, 2 server failure, 3 name error (NXDOMAIN: the name does not exist), 4 not implemented and 5 refused, with 6 to 15 left in reserve in a four-bit field. EDNS adds eight more bits in the OPT record, making a 12-bit code: that is where BADVERS (16) and BADCOOKIE (23) live, and dig prints the combined value.

Each failure has typical causes. RFC 9520 says authoritative servers return SERVFAIL when they have no valid data for a zone, and resolvers for many conditions, DNSSEC validation failure among them; REFUSED usually comes from an authoritative server asked about a zone it does not serve, or from a resolver whose access list excludes the client. A resolver must cache a failure for at least one second and no more than five minutes.

Two readings mislead. NOERROR does not mean an answer arrived: with an empty answer section it is NODATA, which has no code of its own. And dig exits with status 0 for any response, NXDOMAIN included, so a script must read the status line. Extended DNS Errors, an EDNS option, can explain a SERVFAIL without changing the RCODE.

Also known as: response code, dns response code, dns status, nxdomain, servfail, refused

Sources

← All glossary entries