Separate the DNS response code from its explanation
01A DNS Response Code (RCODE) gives the basic result. SERVFAIL means server failure, which can have many causes. Extended DNS Error (EDE) information adds context without replacing that result.
Separate response: RCODE 0, NOERROR, includes EDE 3, Stale Answer. The resolver reports using cached data after it could not resolve within its time limits. Permission and validation rules come from the applicable DNS specifications.
Source for this drawing: RFC 8914 · Read RFC section 1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The response code keeps its normal meaning, with or without an EDE option.
- EDE can accompany any response to a query containing an OPT metadata record: SERVFAIL, NXDOMAIN, REFUSED and even NOERROR.
- Receivers MUST accept EDE in all messages but need not act on it. Applications MUST keep following the applicable RCODE processing requirements.
- EDE 6 means DNSSEC validation ended Bogus. DNSSEC is DNS Security Extensions; the EDE report is not itself proof that validation occurred or that the server is honest.
The examples are separate responses for fictional lab.example, not a sequence of retries. The NOERROR/Stale Answer case assumes another applicable policy permits serving stale data; EDE does not grant that permission or override DNS validation.
Read the RFC section ↗