More detail behind DNS SERVFAILs
When a DNS query ends in a SERVFAIL, the response code alone often leaves you guessing about the root cause. Extended DNS Error (EDE) codes, part of the Extension Mechanisms for DNS (EDNS) spec and defined in the proposed IETF standard RFC 8914, add that missing context without altering the original RCODE. 1.1.1.1 initially adopted these codes in 2020, and now it is expanding the set of supported error types with additional diagnostic text.
To illustrate, consider a query that fails DNSSEC validation without EDE support. The output shows a bare SERVFAIL with no explanation of what went wrong. Running the same query against 1.1.1.1 with EDE enabled changes the picture. The response still contains SERVFAIL, but it now carries EDE Code 9 ("DNSKey Missing") along with the text no SEP matching the DS found for dnssec-failed.org. You know immediately which record is suspect and why validation stopped.
One advantage of the implementation is that 1.1.1.1 returns multiple EDE codes in a single response when more than one problem exists. A single SERVFAIL can thus surface three independent issues at once, for example "Unsupported DNSKEY Algorithm", "No Reachable Authority", and "Network Error". Each error can be investigated on its own rather than chasing a single generic failure.
Checking EDE output yourself
To reproduce these results, use dig or kdig from a terminal. The dig utility needs to be at version 9.11.20 or newer. Note that the default dig on macOS 12.1 is only 9.10.6, so you may need to install a current build of BIND (for instance via Homebrew) to get the required feature set.
Beyond the examples above, 1.1.1.1 has added support for a wider range of error code types. A complete list of the currently supported codes, along with explanatory notes, is available in the developer documentation.
