BADMODE
Bad TKEY Mode
BADMODE (19) is returned when a TKEY (Transaction Key) record specifies a key establishment mode that the server does not support. TKEY (RFC 2930) is used to automatically establish shared secret keys for use with TSIG. BADMODE indicates a mode mismatch between client and server.
RCODE
19
Name
BADMODE
Standard
RFC 2930
Description
TKEY (RFC 2930) defines a mechanism for automatically establishing TSIG shared secrets using Diffie-Hellman key exchange or GSS-API. The TKEY resource record includes a Mode field specifying how the key should be established (server-assigned, Diffie-Hellman, GSS-API negotiated, resolver assignment, key deletion). If the client requests a mode the server does not support, the server returns BADMODE. TKEY is primarily used in Windows Active Directory environments for DNS dynamic updates secured with Kerberos via GSS-TSIG.
Common Causes
- –TKEY mode not supported by the DNS server
- –Client requesting GSS-API TKEY on a server without Kerberos support
- –TKEY mode mismatch in DNS update client configuration