nginx/nginx · error

DNS error (%ui: %s), query id:%ui, name:\"%*s\"

Error message

DNS error (%ui: %s), query id:%ui, name:\"%*s\"

What it means

The resolver server answered FORMERR (rcode 1) and the reply's transaction id matched a query nginx still has in its name resend queue, so nginx logs the rcode, its text from ngx_resolver_strerror, the query id, and the pending name. The reply itself is discarded; the lookup keeps being resent every resend_timeout (default 5s) until resolver_timeout fails the waiting contexts. FORMERR means the server could not parse the query nginx sent.

Source

Thrown at src/core/ngx_resolver.c:1917

                      "unknown query type %ui in DNS response", qtype);
        return;
    }

    return;

short_response:

    err = "short DNS response";

done:

    ngx_log_error(r->log_level, r->log, 0, err);

    return;

dns_error_name:

    ngx_log_error(r->log_level, r->log, 0,
                  "DNS error (%ui: %s), query id:%ui, name:\"%*s\"",
                  code, ngx_resolver_strerror(code), ident,
                  (size_t) rn->nlen, rn->name);
    return;

dns_error:

    ngx_log_error(r->log_level, r->log, 0,
                  "DNS error (%ui: %s), query id:%ui",
                  code, ngx_resolver_strerror(code), ident);
    return;
}


static void
ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t n,
    ngx_uint_t ident, ngx_uint_t code, ngx_uint_t qtype,
    ngx_uint_t nan, ngx_uint_t trunc, ngx_uint_t ans)

View on GitHub (pinned to 3f6f7824d4)

Solutions

  1. Reproduce the exact exchange: dig @resolver <name-from-log> A +noall +comments - a FORMERR status confirms the server rejects the query.
  2. Fix or bypass the failing DNS component: upgrade the resolver software, disable the blocking/rewriting rule, or switch the resolver directive to a healthy upstream (local unbound or public anycast).
  3. For static backends, avoid runtime DNS entirely: proxy_pass with a hostname resolved at config load, or an IP literal.
  4. Set a short resolver_timeout (e.g. 5s) so requests fail fast to upstream retry instead of hanging for the 30s default.

Example fix

# before
resolver 10.0.0.1;
resolver_timeout 30s;

# after - healthy resolvers, fast failure
resolver 127.0.0.1 1.1.1.1 valid=30s;
resolver_timeout 5s;
Defensive patterns

Strategy: fallback

Validate before calling

#!/bin/sh
# health-check: the resolver must never answer FORMERR for your names
for name in api.example.com cdn.example.com; do
  dig @10.0.0.1 $name A +noall +comments | grep -q 'status: FORMERR' \
    && { echo "resolver returns FORMERR for $name"; exit 1; }
done

Try / catch

# nginx has no exceptions; the equivalent of catch for failed runtime DNS is error_page fallback:
server {
    listen 80;
    location / {
        proxy_pass http://dynamic_backend;      # hostname resolved at runtime
        proxy_next_upstream error timeout;
        error_page 502 503 504 = @static_fallback;
    }
    location @static_fallback {
        proxy_pass http://203.0.113.10:8080;    # IP literal, no DNS involved
    }
}

Prevention

When it happens

Trigger: A FORMERR reply whose id matches an outstanding query in name_resend_queue: broken recursive resolvers, DNS proxies that choke on EDNS0/OPT records or long qnames, DNS firewalls that answer FORMERR for blocked domains, or on-path boxes corrupting the query before it reaches the server.

Common situations: Flaky container/VM DNS (older dockerd/skydns builds), resolvers without EDNS support behind modern forwarders, security appliances blocking URL categories with error rcodes, systemd-resolved versions with known FORMERR bugs.

Related errors

AI-assisted analysis of nginx/nginx@3f6f7824d4 (2026-08-22). Data as JSON: /api/errors/1de0a527ff0986a5. Report an issue: GitHub.