BADKEY
Key Not Recognized
BADKEY (17) is a TSIG/SIG(0) error returned when the key name used to sign a DNS message is not recognized by the receiver. The DNS message was signed with a TSIG key that the server does not have configured. The shared secret for the key name does not exist on the server.
RCODE
17
Name
BADKEY
Standard
RFC 8945
Description
TSIG (Transaction Signature, RFC 8945) uses pre-shared symmetric keys identified by name to authenticate DNS messages. When a DNS message includes a TSIG record with a key name the server does not recognize, the server returns BADKEY. This occurs when: the TSIG key name was configured incorrectly on the client, the key was deleted from the server configuration, or the client and server use different key names for the same shared secret. Fix by ensuring both client and server use the same key name in their TSIG configurations.
Common Causes
- –TSIG key name used by client not configured on server
- –Key name typo in TSIG client configuration
- –TSIG key deleted from server configuration
- –Client using wrong key name for zone transfer authentication