Overview & Scope
When a DNS client dispatches a query to a resolver or nameserver, the server responds with a header containing a 4-bit Response Code (RCODE). Understanding these codes is essential for network engineers debugging resolution failures and DNSSEC validation errors.
Specification Table & Matrix
Instant client-side filter by keyword, status code, or directive name
| Key / Code | Definition & Details | GEO Semantic Hierarchy | Spec & Notes |
|---|---|---|---|
| RCODE 0 | NOERROR (RCODE 0) No error condition; the query completed successfully and answer records may be present. status: NOERROR | ●NOERROR ↳DNS RCODE ↳RCODE 0 ↳successful resolution | RFC 1035 §4.1.1 A NOERROR response with 0 answers (NODATA) indicates the domain exists, but has no records for the requested type (e.g. asking for AAAA on an IPv4-only site). |
| RCODE 1 | FORMERR (RCODE 1) Format Error; the name server was unable to interpret the query due to malformed packet syntax. status: FORMERR | ●FORMERR ↳DNS RCODE ↳RCODE 1 ↳malformed query packet | RFC 1035 §4.1.1 Rare; occurs when custom client network code emits corrupted UDP DNS packets. |
| RCODE 2 | SERVFAIL (RCODE 2) Server Failure; the resolver was unable to process the query due to a problem with the authoritative nameservers. status: SERVFAIL | ●SERVFAIL ↳DNS RCODE ↳RCODE 2 ↳nameserver failure or DNSSEC bogus | RFC 1035 §4.1.1 Common causes: authoritative nameservers unreachable, network timeouts, or DNSSEC cryptographic validation failure. |
| RCODE 3 | NXDOMAIN (RCODE 3) Non-Existent Domain; authoritative nameserver asserts that the requested domain name does not exist. status: NXDOMAIN | ●NXDOMAIN ↳DNS RCODE ↳RCODE 3 ↳authoritative non-existence | RFC 1035 §4.1.1 Cached according to the minimum TTL in the SOA record; common for typos, expired domains, or missing subdomains. |
| RCODE 4 | NOTIMP (RCODE 4) Not Implemented; the name server does not support the requested query opcode. status: NOTIMP | ●NOTIMP ↳DNS RCODE ↳RCODE 4 ↳unsupported query operation | RFC 1035 §4.1.1 Triggered when requesting obsolete or experimental DNS opcodes (e.g., IQUERY). |
| RCODE 5 | REFUSED (RCODE 5) Refused; the name server refuses to perform the specified operation for policy or security reasons. status: REFUSED | ●REFUSED ↳DNS RCODE ↳RCODE 5 ↳access policy refusal | RFC 1035 §4.1.1 Occurs when asking a closed enterprise resolver for external recursive lookups (recursion disabled). |
Inspecting DNS RCODE in Terminal
$ dig api.example.com
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 48210
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1
# Note status: NXDOMAIN indicates the domain was not found.
# If status was SERVFAIL, test without DNSSEC validation:
$ dig api.example.com +cdflagThe +cdflag (Checking Disabled) tells the resolver to bypass DNSSEC validation. If +cdflag succeeds, your DNSSEC keys are out of sync.
Reference Standards Q&A
What is the difference between NXDOMAIN and NODATA?↓
References & Primary Sources
Every source below directly substantiates technical statements and protocol behaviors explained in DNS Response Codes (RCODEs) Reference. Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.
- [1]IETFPrimary SpecificationRFC 1034 • Section 3 & 4Verified Primary SourceTechnical Claim Supported:
Establishes the hierarchical distributed domain name space, authoritative name servers, root zone topology, and zone delegations.
Source URI: https://datatracker.ietf.org/doc/html/rfc1034 - [2]IETFPrimary SpecificationRFC 1035 • Section 3.2 (Resource Records)Verified Primary SourceTechnical Claim Supported:
Defines standard DNS Resource Record wire structures (A, CNAME, MX, NS, PTR, SOA) and port 53 UDP/TCP protocol formats.
Source URI: https://datatracker.ietf.org/doc/html/rfc1035 - [3]IETFPrimary SpecificationRFC 8484 • Section 3 & 4Verified Primary SourceTechnical Claim Supported:
Standardizes encrypted DNS query transmission inside HTTP/2 and HTTP/3 HTTPS streams to prevent ISP eavesdropping and on-path manipulation.
Source URI: https://datatracker.ietf.org/doc/html/rfc8484
Related Technical Ecosystem & Next Steps
Related Developer Tools
Related Technical Guides
Related Technical Articles
What Is the Domain Name System (DNS)?
Direct explanation of hierarchical domain resolution from root servers to zone files.
DNS vs DNS-over-HTTPS (DoH): Privacy & Security
Traditional UDP port 53 lookups compared to encrypted TLS-encapsulated DoH queries.
Troubleshooting: DNS Returns NXDOMAIN Error
Diagnose missing records, propagation lag, and nameserver delegation failures.
Related Questions
What Happens When a DNS TTL Expires?
Answer: When a DNS TTL expires, caching resolvers evict the record and must re-query the authoritative nameserver before responding to clients.
Can a CNAME Record Point to an IP Address?
Answer: No, RFC 1034 requires CNAME records to point exclusively to another domain name, never to raw IPv4 or IPv6 addresses.
Why Can't a CNAME Record Coexist With Other Records at the Zone Apex?
Answer: RFC 1034 requires that if a CNAME exists at a node, no other record data may exist there. Since a zone apex must have SOA and NS records, CNAME is prohibited.
Hands-On Diagnostic Labs
Continue Learning
DNS Resolution & Propagation Lab
Trace authoritative resolution from the root servers down to the zone file in the visual DNS workbench.