{"record":{"id":"b51d6d5df329570e","repo":"owasp-amass/amass","slug":"unexpected-response","errorCode":null,"errorMessage":"unexpected response","messagePattern":"unexpected response","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"engine/plugins/support/resolvers.go","lineNumber":139,"sourceCode":"\n\tif dom, err := publicsuffix.EffectiveTLDPlusOne(name); err == nil && dom != \"\" {\n\t\treturn r.WildcardDetected(ctx, resp, dom)\n\t}\n\treturn false\n}\n\nfunc dnsQuery(ctx context.Context, msg *dns.Msg, r *pool.Pool) (*dns.Msg, error) {\n\tif resp, err := r.Exchange(ctx, msg); err != nil {\n\t\treturn nil, err\n\t} else if resp.Rcode == dns.RcodeNameError {\n\t\treturn nil, ErrNameDoesNotExist\n\t} else if resp.Rcode == dns.RcodeSuccess {\n\t\tif len(resp.Answer) == 0 {\n\t\t\treturn nil, ErrNoRecordOfThisType\n\t\t}\n\t\treturn resp, nil\n\t}\n\treturn nil, errors.New(\"unexpected response\")\n}\n\nfunc trustedResolvers() *pool.Pool {\n\ttimeout := 250 * time.Millisecond\n\tcpus := runtime.NumCPU()\n\t// wildcard detector\n\tserv := servers.NewNameserver(\"8.8.4.4\")\n\twconns := conn.New(cpus, selectors.NewSingle(timeout, serv))\n\tdetector = wildcards.NewDetector(serv, wconns, nil)\n\t// the server pool\n\tvar servs []types.Nameserver\n\tfor _, r := range baselineResolvers {\n\t\tservs = append(servs, servers.NewNameserver(r.address))\n\t}\n\tsel := selectors.NewRoundRobin(timeout, servs...)\n\t//sel := selectors.NewAuthoritative(timeout, servers.NewNameserver)\n\tconns := conn.New(cpus, sel)\n\treturn pool.New(0, sel, conns, nil)","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/owasp-amass/amass/blob/79299dce87b0085db0f2f4ef3e9c52cccb49f514/engine/plugins/support/resolvers.go#L121-L157","documentation":"dnsQuery in engine/plugins/support/resolvers.go returns errors.New(\"unexpected response\") as a catch-all when the DNS response Rcode is neither RcodeNameError nor RcodeSuccess — e.g. SERVFAIL, REFUSED, NOTIMP — or otherwise does not fit the handled cases. It indicates the trusted resolver gave an unusable answer rather than a definitive existence verdict.","triggerScenarios":"Calling support.PerformQuery (which calls dnsQuery) and receiving a response whose Rcode is anything other than NOERROR or NXDOMAIN (SERVFAIL, REFUSED, FORMERR, etc.).","commonSituations":"Resolver refusing queries (REFUSED) due to ACLs or rate limiting; SERVFAIL from broken DNSSEC chains or authoritative server issues; misbehaving middleboxes intercepting DNS traffic.","solutions":["Retry, possibly with a different resolver from the pool — many RCodes are transient.","Inspect the actual Rcode with dig @resolver name TYPE to identify SERVFAIL vs REFUSED.","Check resolver reachability/firewall rules and whether the resolver rate-limits your client.","Ensure queries are well-formed (correct name/qtype); FORMERR may indicate a malformed message."],"exampleFix":"// before\nrr, err := support.PerformQuery(ctx, name, dns.TypeA)\nif err != nil {\n    return err\n}\n// after\nrr, err := support.PerformQuery(ctx, name, dns.TypeA)\nif err != nil {\n    if strings.Contains(err.Error(), \"unexpected response\") {\n        log.Warn(\"unusable DNS response (server failure/refused), retrying later\", \"name\", name)\n        return nil\n    }\n    return err\n}","handlingStrategy":"retry","validationCode":"// Verify resolver health before queries\nr := &net.Resolver{}\n_, err := r.LookupHost(context.Background(), \"google.com\")\nif err != nil { log.Warn(\"resolver unhealthy\") }","typeGuard":null,"tryCatchPattern":"rr, err := support.PerformQuery(ctx, name, dns.TypeA)\nif err != nil && strings.Contains(err.Error(), \"unexpected response\") {\n    select {\n    case <-time.After(backoff):\n        rr, err = support.PerformQuery(ctx, name, dns.TypeA)\n    }\n}","preventionTips":["Retry with backoff; SERVFAIL/REFUSED are often transient.","Rotate across multiple trusted resolvers.","Check for firewalls/middleboxes intercepting port 53 traffic.","Diagnose persistent failures with dig to see the raw Rcode."],"tags":["dns","rcode","server-failure"],"backgroundTag":"unexpected-response-shape","analyzedSha":"79299dce87b0085db0f2f4ef3e9c52cccb49f514","analyzedAt":"2026-09-06T08:22:48.198Z","contentChangedAt":"2026-09-06T08:22:48.198Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}