TechnitiumSoftware/DnsServer · error · DnsServerException

All name servers failed to answer the request '{question}'.

Error message

All name servers failed to answer the request '{question}'. Received last response with RCODE={rcode}{metadata}

What it means

Thrown during recursive resolution after querying upstream name servers when the final response RCODE is anything other than NoError/NxDomain/YXDomain (e.g. ServerFailure, Refused, NotImplemented). It indicates the upstream could not (or refused to) answer the query, after retries.

Source

Thrown at DnsServerCore/Dns/DnsServer.cs:5051

                        }, RECURSIVE_RESOLUTION_TIMEOUT);
                    }
                }
                else
                {
                    //do default recursive resolution
                    response = await DefaultRecursiveResolveAsync(question, eDnsClientSubnet, dnsCache, dnssecValidation, skipDnsAppAuthoritativeRequestHandlers);
                }

                switch (response.RCODE)
                {
                    case DnsResponseCode.NoError:
                    case DnsResponseCode.NxDomain:
                    case DnsResponseCode.YXDomain:
                        taskCompletionSource.SetResult(new RecursiveResolveResponse(response, response));
                        break;

                    default:
                        throw new DnsServerException("All name servers failed to answer the request '" + question.ToString() + "'. Received last response with RCODE=" + response.RCODE.ToString() + (response.Metadata is null ? "." : " from: " + response.Metadata.NameServer));
                }
            }
            catch (Exception ex)
            {
                if (_resolverLog is not null)
                {
                    string strForwarders = null;

                    if (conditionalForwarders is not null)
                    {
                        //empty conditional forwarder array is used to force recursive resolution
                        if (conditionalForwarders.Count > 0)
                        {
                            foreach (DnsResourceRecord conditionalForwarder in conditionalForwarders)
                            {
                                NameServerAddress nameServer = (conditionalForwarder.RDATA as DnsForwarderRecordData).NameServer;

                                if (strForwarders is null)

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Switch or add reliable forwarders (e.g. 1.1.1.1, 8.8.8.8, 9.9.9.9) and retry.
2. Check the resolver log (_resolverLog) for the specific name server and RCODE; the message includes the last NS.
3. Verify outbound DNS (UDP/TCP 53, and DoT 853 if used) is not firewalled.
4. Disable DNSSEC validation temporarily to isolate a validation vs. transport issue.
5. Run a direct query (dig @<ns> <name>) to confirm the upstream's behavior outside the server.

// Pre-flight: test forwarder reachability before relying on it
async Task<bool> ForwarderReachable(IPAddress ip)
{
    try { using var u = new UdpClient(); await u.Client.ConnectAsync(new IPEndPoint(ip, 53), TimeSpan.FromSeconds(2)); return true; }
    catch { return false; }
}

try { return await server.ResolveAsync(question); }
catch (DnsServerException ex) when (ex.Message.Contains("All name servers failed")) { log.Warn("Upstream failed; retrying with fallback resolvers"); /* switch forwarders, then retry once */ }

When it happens

Trigger: All configured forwarders/roots returned a non-terminal RCODE; network reachability problems; upstream rate-limiting or RPZ; DNSSEC validation failures producing ServFail; authoritative server misconfiguration.

Common situations: Forwarder IPs wrong or unreachable; ISP DNS blocking; firewall dropping large (TCP/UDP 53 or DoT) packets; upstream under DDoS; recursion/forwarder loop; EDNS0 buffer-size fragmentation; DNSSEC clock skew breaking validation.

Related errors

• Failed to resolve forwarder domain name for all forwarders:
• Network group map contains an invalid network address: {netw
• {httpResponse.StatusCode} {httpResponse.ReasonPhrase}
• Network group map contains an invalid network address: {netw
• Network group map contains an invalid network address: {netw

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/c1643a593a41af2e. Report an issue: GitHub.