跳转到主要内容

Extended DNS error codes

Extended DNS Error Codes (defined in RFC 8914) is a method to return additional information about the cause of DNS errors. When a DNS query fails, the standard response code (such as SERVFAIL) often does not explain why it failed. Extended DNS Error Codes solve this by attaching a more specific error code and descriptive text to the response, so you can identify the exact cause without guesswork.

1.1.1.1 supports Extended DNS Error Codes. Below is a list of error codes 1.1.1.1 returns, what they mean, and steps you may want to take to resolve the issue. Many of these errors relate to DNSSEC (DNS Security Extensions) — the set of protocols that add cryptographic signatures to DNS records to prevent tampering. Extended DNS Error Codes appear automatically in the OPT PSEUDOSECTION of a dig response when the server includes them, for example:

dig @1.1.1.1 example.com A

{/* prettier-ignore */}

Code number Code name Example output Next steps
1

Unsupported DNSKEY Algorithm

 EDE: 1 (Unsupported DNSKEY Algorithm): (failed to verify example.com. A: unsupported key size, DNSKEY example.com., id = 12345) The domain did not pass DNSSEC validation. Check which signature key algorithm your website uses and confirm it is supported by 1.1.1.1.
2 Unsupported DS Digest Type EDE: 2 (Unsupported DS Digest Type): (no supported DS digest type for example.com.) The domain did not pass DNSSEC validation due to an unsupported digest type on the DS record. If none of the provided DS records are supported, the domain will fail to resolve. Make sure to add a supported DS record with your registrar.
3 Stale Answer EDE: 3 (Stale Answer) This is a silent error. It notifies that the DNS resolver could only return stale data. If the issue persists reach out on the 1.1.1.1 community forum.
6 DNSSEC Bogus EDE: 6 (DNSSEC Bogus): (proof of non-existence of example.com. A)

EDE: 6 (DNSSEC Bogus): (found duplicate CNAME records for example.com. (1 duplicate RRs)) 		This domain did not pass DNSSEC validation. The signatures for the target record, or the proof of non-existence of the target records, are invalid. Check your DNS configuration.
7 Signature Expired EDE: 7 (Signature Expired): (for DNSKEY example.com., id = 12345: RRSIG example.com., expiration = 123456) This domain did not pass DNSSEC validation due to an expired signature. Make sure your zone is signed with valid DNSSEC signatures.
8 Signature Not Yet Valid EDE: 8 (Signature Not Yet Valid): (for DNSKEY example.com., id = 12345: RRSIG example.com., inception = 12345) This domain did not pass DNSSEC validation. Make sure your zone is signed with valid DNSSEC signatures.
9 DNSKEY Missing EDE: 9 (DNSKEY Missing): (no SEP matching the DS found for example.com.) This domain did not pass DNSSEC validation. It does not have a SEP DNSKEY that matches the set of DS records at the registry. Make sure to either sign the zone using keys that match the current DS set, or add the missing DS records with your registrar.
10 RRSIGs Missing EDE: 10 (RRSIGs Missing): (for DNSKEY example.com., id = 12345) 1.1.1.1 was unable to retrieve Resource Record Signatures (RRSigs) to verify the authenticity of the records. Check your DNS configuration and the response code. If the response code is not SERVFAIL, this error indicates that there is a non-operational key issue somewhere along the path, but the resolver found at least one successful path for validation. Examples of non-operational key issues include but are not limited to key rollover in-progress, stand-by key, and attacker stripping signatures made by a certain key.
11 No Zone Key Bit Set EDE: 11 (No Zone Key Bit Set): (for DNSKEY example.com., id = 12345) This domain did not pass DNSSEC validation. The zone's SEP DNSKEY must set a Zone Key flag. Check your DNSSEC configuration or DNSSEC's troubleshooting guide.
12 NSEC Missing EDE: 12 (NSEC Missing): failed to verify an insecure referral proof for example.com This domain did not pass DNSSEC validation. The upstream nameserver did not include a valid proof of non-existence for the target name. Make sure the zone is signed with DNSSEC and has valid NSEC/NSEC3 records.
13 Cached Error EDE: 13 (Cached Error) 1.1.1.1 returned a cached error. If this issue persists, reach out to the community forum.
22 No Reachable Authority EDE: 22 (No Reachable Authority): (at delegation example.com.) 1.1.1.1 could not reach some or all of the authoritative nameservers (or they potentially refused to resolve). This can occur if the authoritative nameservers are overloaded or temporarily unavailable. If this issue persists, reach out to the community forum.
23 Network Error EDE: 23 (Network Error): (1.1.1.1:53 rcode=SERVFAIL for example.com. A) 1.1.1.1 could not determine a network path to the upstream nameservers, or the nameserver did not respond. If this issue persists, reach out to the community forum.
30 Invalid Query Type EDE: 30 (Invalid Query Type): Invalid Query Type The record type in the request cannot give a valid answer. If this is returned for standard query types, such as A or AAAA records, please reach out to the community forum.
33 Negative Trust Anchor EDE: 33 (Negative Trust Anchor): (a Negative Trust Anchor has been applied for this query (see RFC 7646)) A Negative Trust Anchor was applied to this query, bypassing DNSSEC validation. Check the Cloudflare status page for any details, and read our blog post on EDE 33 for more information.
这篇文档对你有帮助吗？
想留言或继续讨论？请到 Cyberforums 赛博论坛参与。 参与讨论 / 回复