coredns/coredns · error

max_age can't be negative: %s

Error message

max_age can't be negative: %s

What it means

The forward plugin's `max_age` option caps how long a connection may be reused. parseBlock parses it as a duration and rejects negative values because a maximum age cannot be negative. CoreDNS startup aborts with this message including the invalid value.

Source

Thrown at plugin/forward/setup.go:381

		}
		dur, err := time.ParseDuration(c.Val())
		if err != nil {
			return err
		}
		if dur < 0 {
			return fmt.Errorf("expire can't be negative: %s", dur)
		}
		f.expire = dur
	case "max_age":
		if !c.NextArg() {
			return c.ArgErr()
		}
		dur, err := time.ParseDuration(c.Val())
		if err != nil {
			return err
		}
		if dur < 0 {
			return fmt.Errorf("max_age can't be negative: %s", dur)
		}
		f.maxAge = dur
	case "max_idle_conns":
		if !c.NextArg() {
			return c.ArgErr()
		}
		n, err := strconv.Atoi(c.Val())
		if err != nil {
			return err
		}
		if n < 0 {
			return fmt.Errorf("max_idle_conns can't be negative: %d", n)
		}
		f.maxIdleConns = n
	case "read_timeout":
		if !c.NextArg() {
			return c.ArgErr()
		}

View on GitHub (pinned to 558c9757a9)

Solutions

1. Set a non-negative duration, e.g. `max_age 2m`.
2. Remove the minus sign or fix the generating script's computation.
3. Clamp computed values: if d < 0 { d = 0 } before writing the Corefile.

Example fix

// before
forward . 8.8.8.8 {
    max_age -2m
}
// after
forward . 8.8.8.8 {
    max_age 2m
}

d, err := time.ParseDuration(maxAgeStr)
if err != nil || d < 0 {
    return fmt.Errorf("max_age must be a non-negative duration, got %q", maxAgeStr)
}

if err := coredns.CheckConfig(corefile); err != nil { log.Fatalf("invalid max_age: %v", err) }

When it happens

Trigger: A Corefile line like `max_age -30s` inside a forward block, or a generated/templated value that expanded to a negative duration.

Common situations: Typos adding a minus sign; scripts computing age offsets and passing a negative delta; confusing max_age (non-negative) with values that must be strictly positive like read_timeout.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• cancel: invalid negative duration: %q
• expire can't be negative: %s
• invalid duration
• invalid negative duration for serve_stale
• invalid negative timeout for serve_stale verify

AI-assisted analysis of coredns/coredns@558c9757a9 (2026-09-06). Data as JSON: /api/errors/8a98dcff37c5e98d. Report an issue: GitHub.