BADTIME
Signature Out of Time Window
BADTIME (18) is returned when a TSIG signature is outside the allowed time window. TSIG includes a timestamp and a fudge value (allowed clock skew). If the difference between the server's current time and the timestamp in the TSIG record exceeds the fudge (default 300 seconds), the server returns BADTIME to prevent replay attacks.
RCODE
18
Name
BADTIME
Standard
RFC 8945
Description
TSIG uses timestamps to prevent replay attacks – an attacker cannot replay a captured DNS message because the timestamp will be outside the acceptable window. The default fudge is 300 seconds (5 minutes). If the client's clock is more than 5 minutes different from the server's clock, all TSIG-authenticated requests will fail with BADTIME. This is a common operational issue in containerized environments where NTP is not configured, in VMs with clock drift, or after system sleep. The fix is to synchronize clocks with NTP.
Common Causes
- –Client clock more than 300 seconds (5 min) ahead of server clock
- –NTP not configured or not running on client or server
- –Clock drift in virtualized or containerized environment
- –System returned from sleep/hibernate with stale clock