What Are DNS RCODEs?
DNS Response Codes (RCODEs) are 4-bit values in DNS response messages that indicate the outcome of a query. They're set by the responding nameserver.
The Most Important RCODEs
NOERROR (0)
The query was successful. The answer section may contain records or be empty (empty means the domain exists but has no records of the requested type).
dig example.com A # NOERROR with IP in answerNXDOMAIN (3)
The domain name does not exist. This is different from "no records" — the entire domain is unregistered or undefined.
dig nonexistent-domain-xyz.com # NXDOMAINSERVFAIL (2)
The nameserver encountered an error and couldn't process the query. Common causes:
- DNSSEC validation failure
- Upstream nameserver timeout
- Misconfigured zone file
REFUSED (5)
The server refuses to answer the query. Usually due to access control — the resolver is not allowed to query this nameserver.
NOTIMP (4)
The nameserver doesn't support the query type or opcode.
Debugging with dig
# Check RCODE in response
dig example.com +noall +comments | grep status
# ;; ->>HEADER<<- opcode: QUERY, status: NOERROR
# Use a specific resolver
dig @8.8.8.8 example.com