Skip to content

Extended DNS error codes

Extended DNS Error Codes is a method to return additional information about the cause of DNS errors. As there are many reasons why a DNS query might fail, it became necessary to provide additional information on the exact cause of an error.

1.1.1.1 supports Extended DNS Error Codes. Below is a list of error codes 1.1.1.1 returns, what they mean, and steps you may want to take to resolve the issue.

Code numberCode nameExample outputNext steps
1

Unsupported DNSKEY Algorithm

EDE: 1 (Unsupported DNSKEY Algorithm): (failed to verify example.com. A: unsupported key size, DNSKEY example.com., id = 12345)The domain did not pass DNSSEC validation. Check which signature key algorithm your website uses and confirm it is supported by 1.1.1.1.
2Unsupported DS Digest TypeEDE: 2 (Unsupported DS Digest Type): (no supported DS digest type for example.com.)The domain did not pass DNSSEC validation due to an unsupported digest type on the DS record. If none of the provided DS records are supported, the domain will fail to resolve. Make sure to add a supported DS record with your registrar.
3Stale AnswerEDE: 3 (Stale Answer)This is a silent error. It notifies that the DNS resolver could only return stale data. If the issue persists reach out on the 1.1.1.1 community forum.
6DNSSEC BogusEDE: 6 (DNSSEC Bogus): (proof of non-existence of example.com. A)

EDE: 6 (DNSSEC Bogus): (found duplicate CNAME records for example.com. (1 duplicate RRs))
This domain did not pass DNSSEC validation. The signatures for the target record, or the proof of non-existence of the target records, are invalid. Check your DNS configuration.
7Signature ExpiredEDE: 7 (Signature Expired): (for DNSKEY example.com., id = 12345: RRSIG example.com., expiration = 123456)This domain did not pass DNSSEC validation due to an expired signature. Make sure your zone is signed with valid DNSSEC signatures.
8Signature Not Yet ValidEDE: 8 (Signature Not Yet Valid): (for DNSKEY example.com., id = 12345: RRSIG example.com., inception = 12345)This domain did not pass DNSSEC validation. Make sure your zone is signed with valid DNSSEC signatures.
9DNSKEY MissingEDE: 9 (DNSKEY Missing): (no SEP matching the DS found for example.com.)This domain did not pass DNSSEC validation. It does not have a SEP DNSKEY that matches the set of DS records at the registry. Make sure to either sign the zone using keys that match the current DS set, or add the missing DS records with your registrar.
10RRSIGs MissingEDE: 10 (RRSIGs Missing): (for DNSKEY example.com., id = 12345)1.1.1.1 was unable to retrieve Resource Record Signatures (RRSigs) to verify the authenticity of the records. Check your DNS configuration and the response code. If the response code is not SERVFAIL, this error indicates that there is a non-operational key issue somewhere along the path, but the resolver found at least one successful path for validation. Examples of non-operational key issues include but are not limited to key rollover in-progress, stand-by key, and attacker stripping signatures made by a certain key.
11No Zone Key Bit SetEDE: 11 (No Zone Key Bit Set): (for DNSKEY example.com., id = 12345)This domain did not pass DNSSEC validation. The zone’s SEP DNSKEY must set a Zone Key flag. Check your DNSSEC configuration or DNSSEC’s troubleshooting guide.
12NSEC MissingEDE: 12 (NSEC Missing): failed to verify an insecure referral proof for example.comThis domain did not pass DNSSEC validation. The upstream nameserver did not include a valid proof of non-existence for the target name. Make sure the zone is signed with DNSSEC and has valid NSEC/NSEC3 records.
13Cached ErrorEDE: 13 (Cached Error)1.1.1.1 returned a cached error. If this issue persists, reach out to the community forum.
22No Reachable AuthorityEDE: 22 (No Reachable Authority): (at delegation example.com.)1.1.1.1 could not reach some or all of the authoritative nameservers (or they potentially refused to resolve). This can occur if the authoritative nameservers are overloaded or temporarily unavailable. If this issue persists, reach out to the community forum.
23Network ErrorEDE: 23 (Network Error): (1.1.1.1:53 rcode=SERVFAIL for example.com. A)1.1.1.1 could not determine a network path to the upstream nameservers, or the nameserver did not respond. If this issue persists, reach out to the community forum.