What causes "rCode out of range: {}" in XTLS/Xray-core?

Set "rcode" to a valid DNS response code, typically 0-15 (e.g. 5 for REFUSED, 3 for NXDOMAIN).

rCode out of range: {}

Error message

rCode out of range: {}

What it means

Thrown when building a DNS rule whose 'rcode' field exceeds 65535. DNS RCodes fit in 4 bits (0-15) in the protocol, but Xray stores it as a wider int and only guards the upper bound at 16 bits; anything above 65535 is rejected before the rule is emitted. Valid common values are 0 (NOERROR) through 5 (REFUSED) plus extended codes.

Source

Thrown at infra/conf/dns_proxy.go:53

	if c.QType != nil {
		for _, r := range c.QType.Range {
			for qType := r.From; qType <= r.To; qType++ {
				rule.QType = append(rule.QType, int32(qType))
			}
		}
	}

	if c.Domain != nil {
		rules, err := geodata.ParseDomainRules(*c.Domain, geodata.Domain_Substr)
		if err != nil {
			return nil, err
		}
		rule.Domain = rules
	}

	if c.RCode > 65535 {
		return nil, errors.New("rCode out of range: ", c.RCode)
	}
	rule.RCode = c.RCode

	return rule, nil
}

type DNSOutboundConfig struct {
	RewriteNetwork Network                  `json:"rewriteNetwork"`
	RewriteAddress *Address                 `json:"rewriteAddress"`
	RewritePort    uint16                   `json:"rewritePort"`
	Network        Network                  `json:"network"`
	Address        *Address                 `json:"address"`
	Port           uint16                   `json:"port"`
	UserLevel      uint32                   `json:"userLevel"`
	Rules          []*DNSOutboundRuleConfig `json:"rules"`
	NonIPQuery     *string                  `json:"nonIPQuery"` // todo: remove legacy
	BlockTypes     *[]int32                 `json:"blockTypes"` // todo: remove legacy
}

View on GitHub (pinned to 7d214f8b09)

Solutions

Set "rcode" to a valid DNS response code, typically 0-15 (e.g. 5 for REFUSED, 3 for NXDOMAIN).
If the value came from generated config, clamp/validate it in the generator.
Re-run config validation (xray run -test or xray convert) to confirm the fix.

Example fix

// before
{"action": "return", "rcode": 655360}

// after
{"action": "return", "rcode": 5}

Defensive patterns

Strategy: validation

Validate before calling

func validRCode(rc int32) bool { return rc >= 0 && rc <= 65535 }

// before Build():
if rule.RCode != 0 && !validRCode(rule.RCode) {
    return fmt.Errorf("rcode %d out of range", rule.RCode)
}

Prevention

Stick to standard DNS rcodes 0-15 unless you know you need extended ones.
Generate rcode from an enum, not free-form user input.
Add a schema check for rcode bounds in your config pipeline.

When it happens

Trigger: A DNS rule JSON with "rcode" set to a value > 65535 (e.g. a typo like 655360, or pasting a 32-bit constant). The check `if c.RCode > 65535` fires during DNSRuleConfig.Build().

Common situations: Typos adding an extra digit; confusing rcode with a port number or an IP octet; scripts that generate rcode from user input without clamping.

Related errors

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/3916e2e0f56080be. Report an issue: GitHub.