RFC 8914 / START HERE
Extended DNS errors, before the details
EDE means Extended DNS Error. DNS is Domain Name System, which looks up names such as the fictional lab.example.
RFC 8914 adds an optional reason code and human explanation to DNS responses. It uses EDNS, Extension Mechanisms for DNS, whose OPT record is a special metadata container for one exchange. The ordinary Response Code (RCODE) keeps its normal meaning.
The idea in one picture
DNS response code
Optional EDE reason
Human diagnosis
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
A server failure can have many causes. More context helps diagnose DNS or DNSSEC (DNS Security Extensions) problems, and EDE can even accompany a NOERROR result. It extends the explanation without replacing normal DNS processing or security requirements.
A familiar example
A fictional lookup returns SERVFAIL plus EDE 6, DNSSEC Bogus. That report helps a person investigate validation, but does not authorize falling back to an insecure answer. Extra text can be absent, misleading or sensitive; it is diagnostic information, not proof.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Separate the DNS response code from its explanationA DNS Response Code (RCODE) gives the basic result. SERVFAIL means server failure, which can have many causes. Extended DNS Error (EDE) information adds context without replacing that result.→
- Count the option bytes and keep two code spaces distinctEDNS, Extension Mechanisms for DNS, carries options in an OPT metadata record. An EDE option has its own option code, length, INFO-CODE and optional UTF-8 human text.→
- Carry diagnostics through one DNS exchange at a timeA query advertises EDNS with OPT. Responses may contain several EDE options inside one OPT record; forwarding diagnostic information and managing response size need their own decisions.→
- Read selected reasons without treating the registry as policyReason codes distinguish technical causes and policy origins. RFC 8914 defines an initial set from 0 through 24; later registrations and private values are not invalid merely because this guide does not interpret them.→
- Treat the explanation as untrusted diagnostic textEDE does not authenticate itself. A malicious server or an attacker on an unprotected path can supply misleading reasons, and extra detail can expose information that did not need to leave the server.→
This introduction explains RFC 8914 (2020). Read the original RFC ↗