BADTRUNC
Bad Truncation
BADTRUNC (22) is returned when a TSIG record uses a truncated MAC length that violates the minimum length requirements. RFC 8945 allows truncated MACs but mandates a minimum length. If the truncated MAC is shorter than the allowed minimum, the server returns BADTRUNC.
RCODE
22
Name
BADTRUNC
Standard
RFC 8945
Description
TSIG allows MAC truncation to reduce message size. RFC 8945 §5.2.2.1 specifies that truncated MACs must be at least 10 bytes or half the algorithm's output size, whichever is larger (for HMAC-SHA256: 16 bytes minimum). If a TSIG record contains a truncated MAC shorter than this minimum, the server returns BADTRUNC. This is a security boundary – overly short MACs could weaken authentication. BADTRUNC is rarely encountered in practice since most implementations use full-length MACs.
Common Causes
- –TSIG MAC truncated below the minimum length requirement
- –Custom DNS client using overly aggressive MAC truncation
- –TSIG implementation bug producing undersized MACs