NotAuth
Server Not Authoritative / Not Authorized
NotAuth (9) has two meanings: in DNS UPDATE (RFC 2136), it means the server is not authoritative for the zone being updated. In TSIG/SIG(0) context (RFC 8945), it means the request was not authorized – the authentication credentials were invalid or absent. The specific meaning depends on context.
RCODE
9
Name
NotAuth
Standard
RFC 2136
Description
NotAuth is reused with two meanings in different RFCs. In RFC 2136 (DNS UPDATE), NotAuth indicates the DNS server receiving the update request is not the authoritative server for the zone – the update was sent to the wrong server. In RFC 8945 (TSIG authentication), NotAuth indicates a TSIG authentication failure: the TSIG signature did not verify, the key was not recognized, or the request was not signed when signing is required. The context (DNS UPDATE vs. authenticated query) determines which meaning applies.
Common Causes
- –DNS UPDATE sent to a non-authoritative server for the zone (RFC 2136)
- –TSIG signature on a DNS message did not verify (RFC 8945)
- –TSIG key not recognized by the server
- –Authenticated DNS operation missing required TSIG signature