BADVERS
Bad OPT Version / TSIG Signature Failure
BADVERS (16) has two meanings depending on context. In EDNS0 (RFC 6891), it means the EDNS version in the OPT record is not supported by the server – only EDNS version 0 exists and is supported. In TSIG (RFC 8945), code 16 is BADSIG: the TSIG signature failed to verify.
RCODE
16
Name
BADVERS
Standard
RFC 6891
Description
Code 16 is overloaded. As BADVERS (RFC 6891), it is returned when the OPT record in a query specifies an EDNS version number greater than 0 (which is the only defined version). Practically, BADVERS never occurs with standard clients since EDNS version 0 is always used. As BADSIG (RFC 8945 TSIG), code 16 signals a TSIG signature verification failure – the MAC computed by the server did not match the MAC in the query's TSIG record. TSIG is used for secure DNS zone transfers and dynamic updates.
Common Causes
- –EDNS OPT record specifies version > 0 (BADVERS – no modern client does this)
- –TSIG signature in DNS message does not verify (BADSIG)
- –Shared TSIG key mismatch between client and server
- –Clock skew too large for TSIG time validation