{"record":{"id":"c4af5c2034ca0d67","repo":"coredns/coredns","slug":"invalid-matching-rcode-s-for-a-rcode-rule","errorCode":null,"errorMessage":"invalid matching RCODE '%s' for a rcode rule","messagePattern":"invalid matching RCODE '(.+?)' for a rcode rule","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugin/rewrite/rcode.go","lineNumber":120,"sourceCode":"func (rule *regexRCodeRule) Rewrite(_ctx context.Context, state request.Request) (ResponseRules, Result) {\n\treturn rule.responseRule(len(rule.Pattern.FindStringSubmatch(state.Name())) != 0)\n}\n\n// newRCodeRule creates a name matching rule based on exact, partial, or regex match\nfunc newRCodeRule(nextAction string, args ...string) (Rule, error) {\n\tif len(args) < 3 {\n\t\treturn nil, fmt.Errorf(\"too few (%d) arguments for a rcode rule\", len(args))\n\t}\n\tvar oldStr, newStr string\n\tif len(args) == 3 {\n\t\toldStr, newStr = args[1], args[2]\n\t}\n\tif len(args) == 4 {\n\t\toldStr, newStr = args[2], args[3]\n\t}\n\told, valid := isValidRCode(oldStr)\n\tif !valid {\n\t\treturn nil, fmt.Errorf(\"invalid matching RCODE '%s' for a rcode rule\", oldStr)\n\t}\n\tnew, valid := isValidRCode(newStr)\n\tif !valid {\n\t\treturn nil, fmt.Errorf(\"invalid replacement RCODE '%s' for a rcode rule\", newStr)\n\t}\n\tif len(args) == 4 {\n\t\tswitch strings.ToLower(args[0]) {\n\t\tcase ExactMatch:\n\t\t\treturn &exactRCodeRule{\n\t\t\t\tnewRCodeRuleBase(nextAction, old, new),\n\t\t\t\tplugin.Name(args[1]).Normalize(),\n\t\t\t}, nil\n\t\tcase PrefixMatch:\n\t\t\treturn &prefixRCodeRule{\n\t\t\t\tnewRCodeRuleBase(nextAction, old, new),\n\t\t\t\tplugin.Name(args[1]).Normalize(),\n\t\t\t}, nil\n\t\tcase SuffixMatch:","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/coredns/coredns/blob/558c9757a92b361e550bdba82d0b4ddf3d12d595/plugin/rewrite/rcode.go#L102-L138","documentation":"newRCodeRule validates both RCODEs with isValidRCode, which only accepts symbolic names or numeric codes the DNS library knows. If the FROM (matching) RCODE string is not a valid RCODE identifier, plugin setup fails with this message.","triggerScenarios":"`rewrite stop rcode NXDOMAINR NOERROR` or `rewrite stop rcode 99 NOERROR` — an unknown symbolic name or out-of-range numeric code supplied as the match RCODE.","commonSituations":"Misspelled RCODE names (NXDOMIAN, SERVFAIL typos); using names not in the supported set; confusion between mnemonic and numeric forms.","solutions":["Use a valid RCODE name: NOERROR, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP, REFUSED, etc.","Or use the corresponding valid numeric RCODE value","Check the exact spelling against dns.MessageRcode mappings"],"exampleFix":"# before\nrewrite stop rcode NXDOMAINR NOERROR\n# after\nrewrite stop rcode NXDOMAIN NOERROR","handlingStrategy":"validation","validationCode":"var validRCODEs = map[string]bool{\n\t\"NOERROR\": true, \"FORMERR\": true, \"SERVFAIL\": true, \"NXDOMAIN\": true,\n\t\"NOTIMP\": true, \"REFUSED\": true, \"YXDOMAIN\": true, \"YXRRSET\": true,\n\t\"NXRRSET\": true, \"NOTAUTH\": true, \"BADSIG\": true, \"BADKEY\": true,\n\t\"BADTIME\": true, \"BADMODE\": true, \"BADNAME\": true, \"BADALG\": true,\n\t\"BADTRUNC\": true, \"BADCOOKIE\": true,\n}\nfunc validRCODE(s string) bool { return validRCODEs[s] }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy RCODE names from the dns package constants instead of typing them","Spell-check RCODE mnemonics in config review","Use numeric codes only when the mapping is confirmed valid"],"tags":["dns","coredns","config","invalid-value","rcode"],"backgroundTag":"invalid-enum-value","analyzedSha":"558c9757a92b361e550bdba82d0b4ddf3d12d595","analyzedAt":"2026-09-06T22:47:02.106Z","contentChangedAt":"2026-09-06T22:47:02.106Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}