[DNSOP] Re: return code on RD=0 queries with no answer

REFUSED is policy.  SERVFAIL is current state. 
-- 
Mark Andrews

> On 28 Aug 2026, at 06:44, Colin Vidal <[email protected]> wrote:
> 
> Hi all,
> 
> A recent change in the BIND 9 development branch makes the resolver answer
> SERVFAIL on RD=0 queries if the answer isn't in the cache or other local data.
> 
> Behavior of different implementations varies:
> 
> - Google DNS returns SERVFAIL;
> - Quad9 returns REFUSED;
> - CloudFlare returns SERVFAIL (with EDE 0 "no local cache to fulfill non
>  recursion (RD=0) request");
> - CZ.NIC ODVR returns REFUSED (with EDE 20);
> - BIND >= 9.21.26 now returns SERVFAIL;
> - older BIND returned a referral to the closest available zone cut in
>  cache/local data, or to the root.
> 
> Thinking about this, REFUSED makes sense because the server could answer by
> recursing, and it refused to do that. However, the reason it isn't recursing
> is because the client specified RD=0, not because of a locally configured
> policy. Alternatively, SERVFAIL makes sense because the server isn't able to
> answer this query with the data it has available.
> 
> Any thoughts about what would be the more "correct" return code here?
> 
> If this is not already specified in an RFC, should it be?
> 
> Thanks!
> 
> --
> Colin Vidal -- [email protected]
> Internet Systems Consortium
> 
> _______________________________________________
> DNSOP mailing list -- [email protected]
> To unsubscribe send an email to [email protected]

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]