{"record":{"id":"1de0a527ff0986a5","repo":"nginx/nginx","slug":"dns-error-ui-s-query-id-ui-name-s","errorCode":null,"errorMessage":"DNS error (%ui: %s), query id:%ui, name:\\\"%*s\\\"","messagePattern":"DNS error \\(%ui: (.+?)\\), query id:%ui, name:\\\\\"%\\*s\\\\\"","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/core/ngx_resolver.c","lineNumber":1917,"sourceCode":"                      \"unknown query type %ui in DNS response\", qtype);\n        return;\n    }\n\n    return;\n\nshort_response:\n\n    err = \"short DNS response\";\n\ndone:\n\n    ngx_log_error(r->log_level, r->log, 0, err);\n\n    return;\n\ndns_error_name:\n\n    ngx_log_error(r->log_level, r->log, 0,\n                  \"DNS error (%ui: %s), query id:%ui, name:\\\"%*s\\\"\",\n                  code, ngx_resolver_strerror(code), ident,\n                  (size_t) rn->nlen, rn->name);\n    return;\n\ndns_error:\n\n    ngx_log_error(r->log_level, r->log, 0,\n                  \"DNS error (%ui: %s), query id:%ui\",\n                  code, ngx_resolver_strerror(code), ident);\n    return;\n}\n\n\nstatic void\nngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t n,\n    ngx_uint_t ident, ngx_uint_t code, ngx_uint_t qtype,\n    ngx_uint_t nan, ngx_uint_t trunc, ngx_uint_t ans)","sourceCodeStart":1899,"sourceCodeEnd":1935,"githubUrl":"https://github.com/nginx/nginx/blob/3f6f7824d4e2eb1ac37dec76683d525ac0ff521c/src/core/ngx_resolver.c#L1899-L1935","documentation":"The resolver server answered FORMERR (rcode 1) and the reply's transaction id matched a query nginx still has in its name resend queue, so nginx logs the rcode, its text from ngx_resolver_strerror, the query id, and the pending name. The reply itself is discarded; the lookup keeps being resent every resend_timeout (default 5s) until resolver_timeout fails the waiting contexts. FORMERR means the server could not parse the query nginx sent.","triggerScenarios":"A FORMERR reply whose id matches an outstanding query in name_resend_queue: broken recursive resolvers, DNS proxies that choke on EDNS0/OPT records or long qnames, DNS firewalls that answer FORMERR for blocked domains, or on-path boxes corrupting the query before it reaches the server.","commonSituations":"Flaky container/VM DNS (older dockerd/skydns builds), resolvers without EDNS support behind modern forwarders, security appliances blocking URL categories with error rcodes, systemd-resolved versions with known FORMERR bugs.","solutions":["Reproduce the exact exchange: dig @resolver <name-from-log> A +noall +comments - a FORMERR status confirms the server rejects the query.","Fix or bypass the failing DNS component: upgrade the resolver software, disable the blocking/rewriting rule, or switch the resolver directive to a healthy upstream (local unbound or public anycast).","For static backends, avoid runtime DNS entirely: proxy_pass with a hostname resolved at config load, or an IP literal.","Set a short resolver_timeout (e.g. 5s) so requests fail fast to upstream retry instead of hanging for the 30s default."],"exampleFix":"# before\nresolver 10.0.0.1;\nresolver_timeout 30s;\n\n# after - healthy resolvers, fast failure\nresolver 127.0.0.1 1.1.1.1 valid=30s;\nresolver_timeout 5s;","handlingStrategy":"fallback","validationCode":"#!/bin/sh\n# health-check: the resolver must never answer FORMERR for your names\nfor name in api.example.com cdn.example.com; do\n  dig @10.0.0.1 $name A +noall +comments | grep -q 'status: FORMERR' \\\n    && { echo \"resolver returns FORMERR for $name\"; exit 1; }\ndone","typeGuard":null,"tryCatchPattern":"# nginx has no exceptions; the equivalent of catch for failed runtime DNS is error_page fallback:\nserver {\n    listen 80;\n    location / {\n        proxy_pass http://dynamic_backend;      # hostname resolved at runtime\n        proxy_next_upstream error timeout;\n        error_page 502 503 504 = @static_fallback;\n    }\n    location @static_fallback {\n        proxy_pass http://203.0.113.10:8080;    # IP literal, no DNS involved\n    }\n}","preventionTips":["List at least two healthy resolvers in the resolver directive so one bad path is not fatal.","Set resolver_timeout 5s or lower to fail fast toward upstream retry or error_page handling.","Use statically-resolved proxy_pass (hostname without variables) or IP literals for critical backends.","Track resolver software versions in DNS infrastructure and upgrade components known to emit FORMERR."],"tags":["dns","resolver","nginx","formerr","rcode"],"backgroundTag":"dns-response-code-error","analyzedSha":"3f6f7824d4e2eb1ac37dec76683d525ac0ff521c","analyzedAt":"2026-08-22T03:09:46.447Z","schemaVersion":2},"datasetVersion":"2026-08-22T04:17:13.399Z"}