Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What do the DNS response codes (NOERROR, NXDOMAIN, SERVFAIL, REFUSED) mean?
Short answer
Every DNS response carries in its header a response code (RCODE) that reports the result of the query (RFC 1035, IANA DNS Parameters). NOERROR reports that the query was answered without error (that the name exists even if there is no record of the requested type), NXDOMAIN that the queried name does not exist at all, SERVFAIL that the server encountered an error while producing the response, REFUSED that the server refused to answer the query (e.g. for a name it is not authoritative for), and NOTIMP that the requested operation is not supported. In TR7 GTM, the DNS service dashboard's DNS Response Codes panel shows these five codes in separate series and the other codes in the Other series, which is hidden by default; growth of the NXDOMAIN or SERVFAIL band shows that queries toward non-existent names or response errors have increased.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| GTM → GTM Services → service name → Dashboard → Summary | DNS Response Codes panel (NOERROR, NXDOMAIN, SERVFAIL, REFUSED, NOTIMP, Other) | Response code distribution of the responses the service gives |
| Same dashboard → System | DNS Errors panel (Corrupt Packets, Timed Out, Server Failures, Unauthorized) | Rate of corrupt packets, timeouts, server failures and unauthorized queries |
| GTM → GTM Services → service name → Domains → domain preview → Dashboard | Existent/Nonexistent panel | Share of the queries coming to existing and non-existing names in the domain |
Codes
| Code | Value | Meaning | Typical cause |
|---|---|---|---|
| NOERROR | 0 | Response without error | The name exists; if there is no record of the requested type, the answer section comes back empty (NODATA) |
| SERVFAIL | 2 | Server failure | Error while producing the response; in recursion, the upstream server cannot be reached |
| NXDOMAIN | 3 | Name does not exist | Misspelling, deleted record, scan trying non-existent names |
| NOTIMP | 4 | Not supported | Operation type the server does not support |
| REFUSED | 5 | Refused | Name the server is not authoritative for, policy restriction |
Common Misconceptions
- "NOERROR always means an address was returned." If the name exists but there is no record of the requested type, the response is NOERROR and the answer section comes back empty.
- "An increase in NXDOMAIN is always a failure." Scanning or attack traffic that tries non-existent names also increases NXDOMAIN; it is read together with the Existent/Nonexistent panel on the domain dashboard.
- "A code that does not appear on the panel does not exist at all." Responses outside the five codes are collected in the Other series and this series is hidden by default; its not appearing does not mean that those codes have not occurred.
How it is done in the documentation
