Übersicht & Anwendungsbereich
Die RFC 1035- und RFC 6895-Standards bieten eine präzise Nomenklatur zur Diagnose von Verbindungsproblemen und DNSSEC-Fehlern.
Spezifikationstabelle & Matrix
Echtzeit-Filter nach Stichwort, Statuscode oder Direktive
| Schlüssel / Code | Definition & Details | Semantische GEO-Hierarchie | Spezifikation & Hinweise |
|---|---|---|---|
| RCODE 0 | NOERROR (RCODE 0) No error condition; the query completed successfully and answer records may be present. status: NOERROR | ●NOERROR ↳DNS RCODE ↳RCODE 0 ↳successful resolution | RFC 1035 §4.1.1 A NOERROR response with 0 answers (NODATA) indicates the domain exists, but has no records for the requested type (e.g. asking for AAAA on an IPv4-only site). |
| RCODE 1 | FORMERR (RCODE 1) Format Error; the name server was unable to interpret the query due to malformed packet syntax. status: FORMERR | ●FORMERR ↳DNS RCODE ↳RCODE 1 ↳malformed query packet | RFC 1035 §4.1.1 Rare; occurs when custom client network code emits corrupted UDP DNS packets. |
| RCODE 2 | SERVFAIL (RCODE 2) Server Failure; the resolver was unable to process the query due to a problem with the authoritative nameservers. status: SERVFAIL | ●SERVFAIL ↳DNS RCODE ↳RCODE 2 ↳nameserver failure or DNSSEC bogus | RFC 1035 §4.1.1 Common causes: authoritative nameservers unreachable, network timeouts, or DNSSEC cryptographic validation failure. |
| RCODE 3 | NXDOMAIN (RCODE 3) Non-Existent Domain; authoritative nameserver asserts that the requested domain name does not exist. status: NXDOMAIN | ●NXDOMAIN ↳DNS RCODE ↳RCODE 3 ↳authoritative non-existence | RFC 1035 §4.1.1 Cached according to the minimum TTL in the SOA record; common for typos, expired domains, or missing subdomains. |
| RCODE 4 | NOTIMP (RCODE 4) Not Implemented; the name server does not support the requested query opcode. status: NOTIMP | ●NOTIMP ↳DNS RCODE ↳RCODE 4 ↳unsupported query operation | RFC 1035 §4.1.1 Triggered when requesting obsolete or experimental DNS opcodes (e.g., IQUERY). |
| RCODE 5 | REFUSED (RCODE 5) Refused; the name server refuses to perform the specified operation for policy or security reasons. status: REFUSED | ●REFUSED ↳DNS RCODE ↳RCODE 5 ↳access policy refusal | RFC 1035 §4.1.1 Occurs when asking a closed enterprise resolver for external recursive lookups (recursion disabled). |
Inspecting DNS RCODE in Terminal
$ dig api.example.com
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 48210
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1
# Note status: NXDOMAIN indicates the domain was not found.
# If status was SERVFAIL, test without DNSSEC validation:
$ dig api.example.com +cdflagThe +cdflag (Checking Disabled) tells the resolver to bypass DNSSEC validation. If +cdflag succeeds, your DNSSEC keys are out of sync.
Standard-Spezifikation Q&A
What is the difference between NXDOMAIN and NODATA?↓
References & Primary Sources
Every source below directly substantiates technical statements and protocol behaviors explained in DNS-Antwortcodes (RCODEs) Referenz. Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.
- [1]IETFPrimary SpecificationRFC 1034 • Section 3 & 4Verified Primary SourceTechnical Claim Supported:
Establishes the hierarchical distributed domain name space, authoritative name servers, root zone topology, and zone delegations.
Source URI: https://datatracker.ietf.org/doc/html/rfc1034 - [2]IETFPrimary SpecificationRFC 1035 • Section 3.2 (Resource Records)Verified Primary SourceTechnical Claim Supported:
Defines standard DNS Resource Record wire structures (A, CNAME, MX, NS, PTR, SOA) and port 53 UDP/TCP protocol formats.
Source URI: https://datatracker.ietf.org/doc/html/rfc1035 - [3]IETFPrimary SpecificationRFC 8484 • Section 3 & 4Verified Primary SourceTechnical Claim Supported:
Standardizes encrypted DNS query transmission inside HTTP/2 and HTTP/3 HTTPS streams to prevent ISP eavesdropping and on-path manipulation.
Source URI: https://datatracker.ietf.org/doc/html/rfc8484
Zugehöriges technisches Ökosystem & nächste Schritte
Verwandte Entwickler-Werkzeuge
Verwandte Leitfäden
Verwandte Fachartikel
What Is the Domain Name System (DNS)?
Direct explanation of hierarchical domain resolution from root servers to zone files.
DNS vs DNS-over-HTTPS (DoH): Privacy & Security
Traditional UDP port 53 lookups compared to encrypted TLS-encapsulated DoH queries.
Troubleshooting: DNS Returns NXDOMAIN Error
Diagnose missing records, propagation lag, and nameserver delegation failures.
Verwandte technische Fragen
What Happens When a DNS TTL Expires?
Answer: When a DNS TTL expires, caching resolvers evict the record and must re-query the authoritative nameserver before responding to clients.
Can a CNAME Record Point to an IP Address?
Answer: No, RFC 1034 requires CNAME records to point exclusively to another domain name, never to raw IPv4 or IPv6 addresses.
Why Can't a CNAME Record Coexist With Other Records at the Zone Apex?
Answer: RFC 1034 requires that if a CNAME exists at a node, no other record data may exist there. Since a zone apex must have SOA and NS records, CNAME is prohibited.
Praxis-Diagnoselabore
Weiterlernen
DNS Resolution & Propagation Lab
Trace authoritative resolution from the root servers down to the zone file in the visual DNS workbench.