Skip to main content
protocols.pageprotocols.page
5

Refused

Query Refused

Core RCODERFC 1035

Refused (5) means the DNS server understood the query but declined to answer it due to policy. Unlike NotImp (feature not supported), Refused means the server can answer but policy prevents it. The most common cause is a recursive query sent to an authoritative-only server that is not configured to perform recursion for this client.

RCODE

5

Name

Refused

Standard

RFC 1035

Description

REFUSED is a policy-based rejection. Authoritative DNS servers typically refuse recursive queries from the public internet (open recursion is a security risk enabling DNS amplification attacks). If a client sends a recursive query to an authoritative-only nameserver, it receives REFUSED. Zone transfer requests (AXFR/IXFR) are commonly refused to unauthorized clients. DNS servers can also refuse queries based on source IP access control lists. REFUSED is the correct response for policy-based rejections; NOTIMP should be used for capability-based rejections.

Common Causes

  • –Recursive query sent to an authoritative-only DNS server
  • –Zone transfer (AXFR) request from unauthorized IP
  • –Query from IP not permitted by server ACL
  • –Rate limit exceeded triggering query refusal
RFC 1035 – DNS RCODE specification →