{"record":{"id":"3916e2e0f56080be","repo":"XTLS/Xray-core","slug":"rcode-out-of-range","errorCode":null,"errorMessage":"rCode out of range: {}","messagePattern":"rCode out of range: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/dns_proxy.go","lineNumber":53,"sourceCode":"\n\tif c.QType != nil {\n\t\tfor _, r := range c.QType.Range {\n\t\t\tfor qType := r.From; qType <= r.To; qType++ {\n\t\t\t\trule.QType = append(rule.QType, int32(qType))\n\t\t\t}\n\t\t}\n\t}\n\n\tif c.Domain != nil {\n\t\trules, err := geodata.ParseDomainRules(*c.Domain, geodata.Domain_Substr)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\trule.Domain = rules\n\t}\n\n\tif c.RCode > 65535 {\n\t\treturn nil, errors.New(\"rCode out of range: \", c.RCode)\n\t}\n\trule.RCode = c.RCode\n\n\treturn rule, nil\n}\n\ntype DNSOutboundConfig struct {\n\tRewriteNetwork Network                  `json:\"rewriteNetwork\"`\n\tRewriteAddress *Address                 `json:\"rewriteAddress\"`\n\tRewritePort    uint16                   `json:\"rewritePort\"`\n\tNetwork        Network                  `json:\"network\"`\n\tAddress        *Address                 `json:\"address\"`\n\tPort           uint16                   `json:\"port\"`\n\tUserLevel      uint32                   `json:\"userLevel\"`\n\tRules          []*DNSOutboundRuleConfig `json:\"rules\"`\n\tNonIPQuery     *string                  `json:\"nonIPQuery\"` // todo: remove legacy\n\tBlockTypes     *[]int32                 `json:\"blockTypes\"` // todo: remove legacy\n}","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/dns_proxy.go#L35-L71","documentation":"Thrown when building a DNS rule whose 'rcode' field exceeds 65535. DNS RCodes fit in 4 bits (0-15) in the protocol, but Xray stores it as a wider int and only guards the upper bound at 16 bits; anything above 65535 is rejected before the rule is emitted. Valid common values are 0 (NOERROR) through 5 (REFUSED) plus extended codes.","triggerScenarios":"A DNS rule JSON with \"rcode\" set to a value > 65535 (e.g. a typo like 655360, or pasting a 32-bit constant). The check `if c.RCode > 65535` fires during DNSRuleConfig.Build().","commonSituations":"Typos adding an extra digit; confusing rcode with a port number or an IP octet; scripts that generate rcode from user input without clamping.","solutions":["Set \"rcode\" to a valid DNS response code, typically 0-15 (e.g. 5 for REFUSED, 3 for NXDOMAIN).","If the value came from generated config, clamp/validate it in the generator.","Re-run config validation (xray run -test or xray convert) to confirm the fix."],"exampleFix":"// before\n{\"action\": \"return\", \"rcode\": 655360}\n\n// after\n{\"action\": \"return\", \"rcode\": 5}","handlingStrategy":"validation","validationCode":"func validRCode(rc int32) bool { return rc >= 0 && rc <= 65535 }\n\n// before Build():\nif rule.RCode != 0 && !validRCode(rule.RCode) {\n    return fmt.Errorf(\"rcode %d out of range\", rule.RCode)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Stick to standard DNS rcodes 0-15 unless you know you need extended ones.","Generate rcode from an enum, not free-form user input.","Add a schema check for rcode bounds in your config pipeline."],"tags":["go","xray","dns","config","validation","numeric-range"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}