REFUSED is policy. SERVFAIL is current state. -- Mark Andrews > On 28 Aug 2026, at 06:44, Colin Vidal <[email protected]> wrote: > > Hi all, > > A recent change in the BIND 9 development branch makes the resolver answer > SERVFAIL on RD=0 queries if the answer isn't in the cache or other local data. > > Behavior of different implementations varies: > > - Google DNS returns SERVFAIL; > - Quad9 returns REFUSED; > - CloudFlare returns SERVFAIL (with EDE 0 "no local cache to fulfill non > recursion (RD=0) request"); > - CZ.NIC ODVR returns REFUSED (with EDE 20); > - BIND >= 9.21.26 now returns SERVFAIL; > - older BIND returned a referral to the closest available zone cut in > cache/local data, or to the root. > > Thinking about this, REFUSED makes sense because the server could answer by > recursing, and it refused to do that. However, the reason it isn't recursing > is because the client specified RD=0, not because of a locally configured > policy. Alternatively, SERVFAIL makes sense because the server isn't able to > answer this query with the data it has available. > > Any thoughts about what would be the more "correct" return code here? > > If this is not already specified in an RFC, should it be? > > Thanks! > > -- > Colin Vidal -- [email protected] > Internet Systems Consortium > > _______________________________________________ > DNSOP mailing list -- [email protected] > To unsubscribe send an email to [email protected]
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
