Extended DNS Error Codes ↗ (defined in RFC 8914) is a method to return additional information about the cause of DNS errors. When a DNS query fails, the standard response code (such as SERVFAIL) often does not explain why it failed. Extended DNS Error Codes solve this by attaching a more specific error code and descriptive text to the response, so you can identify the exact cause without guesswork.
1.1.1.1 supports Extended DNS Error Codes. Below is a list of error codes 1.1.1.1 returns, what they mean, and steps you may want to take to resolve the issue. Many of these errors relate to DNSSEC (DNS Security Extensions) — the set of protocols that add cryptographic signatures to DNS records to prevent tampering. Extended DNS Error Codes appear automatically in the OPT PSEUDOSECTION of a dig response when the server includes them, for example:
dig @1.1.1.1 example.com A| Code number | Code name | Example output | Next steps |
|---|---|---|---|
| 1 | Unsupported DNSKEY Algorithm | EDE: 1 (Unsupported DNSKEY Algorithm): (failed to verify example.com. A: unsupported key size, DNSKEY example.com., id = 12345) | The domain did not pass DNSSEC validation. Check which signature key algorithm your website uses and confirm it is supported by 1.1.1.1. |
| 2 | Unsupported DS Digest Type | EDE: 2 (Unsupported DS Digest Type): (no supported DS digest type for example.com.) | The domain did not pass DNSSEC validation due to an unsupported digest type on the DS record. If none of the provided DS records are supported, the domain will fail to resolve. Make sure to add a supported DS record with your registrar. |
| 3 | Stale Answer | EDE: 3 (Stale Answer) | This is a silent error. It notifies that the DNS resolver could only return stale data. If the issue persists reach out on the 1.1.1.1 community forum. |
| 6 | DNSSEC Bogus | EDE: 6 (DNSSEC Bogus): (proof of non-existence of example.com. A)EDE: 6 (DNSSEC Bogus): (found duplicate CNAME records for example.com. (1 duplicate RRs)) | This domain did not pass DNSSEC validation. The signatures for the target record, or the proof of non-existence of the target records, are invalid. Check your DNS configuration. |
| 7 | Signature Expired | EDE: 7 (Signature Expired): (for DNSKEY example.com., id = 12345: RRSIG example.com., expiration = 123456) | This domain did not pass DNSSEC validation due to an expired signature. Make sure your zone is signed with valid DNSSEC signatures. |
| 8 |