BADALG
Algorithm Not Supported
BADALG (21) is returned when a TKEY or TSIG record specifies a cryptographic algorithm that the server does not support. The algorithm identifier in the TSIG or TKEY record is not recognized or not implemented by the receiving server.
RCODE
21
Name
BADALG
Standard
RFC 2930
Description
TSIG and TKEY records include an algorithm name identifying the MAC or key exchange algorithm to use. RFC 8945 defines standard algorithm names including hmac-sha256, hmac-sha384, hmac-sha512, and hmac-sha1 (deprecated). If a client sends a TSIG with an algorithm name the server does not support, the server returns BADALG. This is increasingly relevant as deployments upgrade from hmac-md5 (now broken and deprecated) to stronger algorithms. Servers should support at minimum hmac-sha256.
Common Causes
- –TSIG algorithm not supported by server (e.g., hmac-md5 disabled)
- –Unsupported TKEY key exchange algorithm
- –Client and server configured with different TSIG algorithm names