DNS SERVFAIL Responses Get a Diagnostic Upgrade

Cloudflare has updated its 1.1.1.1 resolver to include Extended DNS Errors (EDE) in certain responses. This optional data, defined in an IETF draft, gives clients a clearer picture of why a DNS query failed, without altering the standard response code.

The limits of the SERVFAIL catch-all

The DNS protocol uses a 4-bit field called RCODE to communicate the outcome of a lookup. Over time, as extensions like DNSSEC were layered on, that small field became too cramped to express all the possible internal states of a server. To stay backward compatible, servers often have to map distinct failure conditions onto the same generic codes — most notably SERVFAIL, which says something went wrong, but not what.

For a typical end user, the path to an answer goes through a stub resolver and then a recursive resolver. A SERVFAIL response can originate from any point in that chain:

  • The stub resolver itself fails to send or receive a request.
  • The recursive resolver is overloaded or cannot reach the authoritative servers.
  • DNSSEC chain validation fails at the resolver.
  • An authoritative server responds too slowly or not at all.

Because the resolver acts as the client’s agent, it usually takes the blame when an answer doesn’t come back — and until now, it had no standard way to pass along a more precise reason.

A backward-compatible fix via EDNS

Extending the RCODE space itself is possible through EDNS, which adds an 8-bit EXTENDED-RCODE on top of the existing 4 bits. But that approach requires both client and server to fully understand the extended logic, a heavier lift for compatibility.

Extended DNS Errors take a different route: they add a new EDNS option without touching the RCODE. The option holds a 16-bit INFO-CODE that describes the error type, plus an optional UTF-8 EXTRA-TEXT for additional context. Multiple options can be included in a single response, so a client can receive a full chain of errors — for example, one from an authoritative server indicating it isn’t ready, and another from the resolver explaining it couldn’t reach a second name server. This is similar to the diagnostic “Comment” field Google exposes in its DoH JSON API, but standardized at the protocol level.

Live on 1.1.1.1

Cloudflare’s resolver now offers initial support for the draft version of EDE. Since the RCODE remains unchanged, existing clients are unaffected; the extra option can be safely ignored by anyone not interested in it.

With a recent enough version of dig, users can see the new data in action by querying a domain known to have issues. A typical response might still show SERVFAIL as the RCODE — for instance, when DNSSEC validation fails — but the extended error in the OPT record will pin the problem down to “DNSSEC Bogus.”

One caveat: EDE depends on EDNS, so the client must request and support it. Cloudflare observes that only about 17% of queries it receives currently have EDNS enabled. As adoption grows, this extra layer of detail should make troubleshooting SERVFAIL far less of a guessing game.