TechnitiumSoftware/DnsServer · error · DnsServerException

All name servers failed to answer the request

Error message

All name servers failed to answer the request '{question}'. Received last response with RCODE={rcode}{metadata}

What it means

Thrown during recursive resolution after querying upstream name servers when the final response RCODE is anything other than NoError/NxDomain/YXDomain (e.g. ServerFailure, Refused, NotImplemented). It indicates the upstream could not (or refused to) answer the query, after retries.

Solutions

1. Switch or add reliable forwarders (e.g. 1.1.1.1, 8.8.8.8, 9.9.9.9) and retry.
2. Check the resolver log (_resolverLog) for the specific name server and RCODE; the message includes the last NS.
3. Verify outbound DNS (UDP/TCP 53, and DoT 853 if used) is not firewalled.
4. Disable DNSSEC validation temporarily to isolate a validation vs. transport issue.
5. Run a direct query (dig @<ns> <name>) to confirm the upstream's behavior outside the server.

// Pre-flight: test forwarder reachability before relying on it
async Task<bool> ForwarderReachable(IPAddress ip)
{
    try { using var u = new UdpClient(); await u.Client.ConnectAsync(new IPEndPoint(ip, 53), TimeSpan.FromSeconds(2)); return true; }
    catch { return false; }
}

try { return await server.ResolveAsync(question); }
catch (DnsServerException ex) when (ex.Message.Contains("All name servers failed")) { log.Warn("Upstream failed; retrying with fallback resolvers"); /* switch forwarders, then retry once */ }

When it happens

Trigger: All configured forwarders/roots returned a non-terminal RCODE; network reachability problems; upstream rate-limiting or RPZ; DNSSEC validation failures producing ServFail; authoritative server misconfiguration.

Common situations: Forwarder IPs wrong or unreachable; ISP DNS blocking; firewall dropping large (TCP/UDP 53 or DoT) packets; upstream under DDoS; recursion/forwarder loop; EDNS0 buffer-size fragmentation; DNSSEC clock skew breaking validation.

Related errors

• Failed to resolve forwarder domain name for all forwarders
• An IPv6 network address is expected for 'excludedIpv6'…
• Automatic rollover is not supported for Key Signing Keys…
• Cannot activate private key: no such private key was found.
• Cannot add DNSSEC record.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/c1643a593a41af2e. Report an issue: GitHub.

Appendix: source

Thrown at DnsServerCore/Dns/DnsServer.cs:5051

                        }, RECURSIVE_RESOLUTION_TIMEOUT);
                    }
                }
                else
                {
                    //do default recursive resolution
                    response = await DefaultRecursiveResolveAsync(question, eDnsClientSubnet, dnsCache, dnssecValidation, skipDnsAppAuthoritativeRequestHandlers);
                }

                switch (response.RCODE)
                {
                    case DnsResponseCode.NoError:
                    case DnsResponseCode.NxDomain:
                    case DnsResponseCode.YXDomain:
                        taskCompletionSource.SetResult(new RecursiveResolveResponse(response, response));
                        break;

                    default:
                        throw new DnsServerException("All name servers failed to answer the request '" + question.ToString() + "'. Received last response with RCODE=" + response.RCODE.ToString() + (response.Metadata is null ? "." : " from: " + response.Metadata.NameServer));
                }
            }
            catch (Exception ex)
            {
                if (_resolverLog is not null)
                {
                    string strForwarders = null;

                    if (conditionalForwarders is not null)
                    {
                        //empty conditional forwarder array is used to force recursive resolution
                        if (conditionalForwarders.Count > 0)
                        {
                            foreach (DnsResourceRecord conditionalForwarder in conditionalForwarders)
                            {
                                NameServerAddress nameServer = (conditionalForwarder.RDATA as DnsForwarderRecordData).NameServer;

                                if (strForwarders is null)

View on GitHub (pinned to d0484b6c1e)