BADCOOKIE
Bad/Missing Server Cookie
BADCOOKIE (23) is returned when a DNS query includes a Server Cookie that does not match what the server expects, or when a server requires cookies and the client did not send one. DNS Cookies (RFC 7873) are a lightweight mechanism to protect against DNS amplification attacks and cache poisoning.
RCODE
23
Name
BADCOOKIE
Standard
RFC 7873
Description
DNS Cookies (RFC 7873) use a client cookie (8 bytes, persistent per server) and a server cookie (8-32 bytes, generated by the server). The client includes both in subsequent queries to authenticate itself. BADCOOKIE is returned when: the client sends a server cookie the server cannot validate (stale or from a different server in a cluster), or when the server requires cookies and the client's query has none. When a client receives BADCOOKIE, it should retry the query using the new server cookie provided in the BADCOOKIE response. DNS Cookies help prevent IP-spoofed DNS amplification attacks.
Common Causes
- –Client sent a stale server cookie (server rotated its cookie secret)
- –Client connected to a different server in a cluster without a matching cookie
- –Server requires cookies but client sent a query without them
- –Server cookie secret rotation in a DNS server cluster