DNS Code Reference

OxiDNS usually accepts both decimal numbers and mnemonic names in qtype, qclass, and rcode matchers, as well as in reject [rcode]. Mnemonic names are case-insensitive, so SERVFAIL, servfail, and ServFail all refer to the same RCODE.

Unknown or future QTYPE, QCLASS, and RCODE values can be matched with decimal numbers. reject [rcode] is the exception: it can only generate base DNS RCODEs 0..15; extended RCODEs require EDNS OPT and are not generated by that built-in action.

RCODE Response Codes

Number	Code	Meaning
0	NOERROR	The query succeeded and the response has no error. A response with no answers is usually NODATA, not NXDOMAIN.
1	FORMERR	The request format is invalid and the server cannot parse it.
2	SERVFAIL	Server failure, often caused by upstream failure, validation failure, or an internal error.
3	NXDOMAIN	The queried domain name does not exist.
4	NOTIMP	The server does not implement the requested operation.
5	REFUSED	The server refuses to process the query, commonly for policy or authorization reasons.
6	YXDOMAIN	DNS UPDATE: a name exists when it should not.
7	YXRRSET	DNS UPDATE: an RRSet exists when it should not.
8	NXRRSET	DNS UPDATE: an RRSet that should exist does not exist.
9	NOTAUTH	The server is not authoritative for the zone, or the operation is not authorized.
10	NOTZONE	The name is not contained in the specified zone.
11..15	Unassigned	Empty range in base RCODEs. reject can accept these numbers, but they are usually not recommended for normal policies.
16	BADVERS / BADSIG	EDNS: bad OPT version; TSIG: signature failure. The meaning depends on context.
17	BADKEY	TSIG/TKEY key is not recognized.
18	BADTIME	TSIG signature is outside the valid time window.
19	BADMODE	Bad TKEY mode.
20	BADNAME	Duplicate or invalid TKEY name.
21	BADALG	Algorithm not supported.
22	BADTRUNC	Bad TSIG truncation.
23	BADCOOKIE	Missing or invalid EDNS Cookie.

Common policy examples:

- matches: "rcode SERVFAIL,3"
  exec: "forward 8.8.8.8"

- matches: "qname domain:blocked.example"
  exec: "reject NXDOMAIN"

QCLASS Query Classes

Number	Code	Meaning
1	IN	Internet; used by almost all ordinary DNS queries.
2	CS	CSNET; historical and rarely used today.
3	CH	CHAOS; sometimes used by diagnostic queries.
4	HS	Hesiod; historical.
254	NONE	Used by DNS UPDATE to indicate no class.
255	ANY / *	Any class, mainly used for special queries or matching expressions.

Common policy example:

- matches: "qclass IN"
  exec: "$forward_main"

QTYPE Query Types

Number	Code	Meaning
1	A	IPv4 address record.
2	NS	Authoritative name server record.
5	CNAME	Canonical name alias record.
6	SOA	Start of authority record; also commonly used for negative-cache TTLs.
12	PTR	Reverse lookup pointer record.
15	MX	Mail exchange record.
16	TXT	Text record, often used for SPF, verification, and policy text.
28	AAAA	IPv6 address record.
33	SRV	Service locator record.
35	NAPTR	Naming Authority Pointer record, often used for service discovery.
41	OPT	EDNS pseudo-record; not an ordinary resource record.
43	DS	DNSSEC delegation signer record.
46	RRSIG	DNSSEC record signature.
47	NSEC	DNSSEC denial-of-existence record.
48	DNSKEY	DNSSEC public key record.
50	NSEC3	DNSSEC NSEC3 denial-of-existence record.
51	NSEC3PARAM	NSEC3 parameter record.
52	TLSA	DANE TLSA certificate association record.
64	SVCB	Service Binding record.
65	HTTPS	HTTPS Service Binding record.
99	SPF	Dedicated SPF record type; in real deployments, TXT is more common.
249	TKEY	Transaction key negotiation record.
250	TSIG	Transaction signature pseudo-record.
251	IXFR	Incremental zone transfer.
252	AXFR	Full zone transfer.
255	ANY / *	Request records of any type; recursive resolvers often restrict or minimize responses.
256	URI	URI record.
257	CAA	Certification Authority Authorization record.
261	RESINFO	Resolver information record.

Common policy example:

- matches: "qtype A,AAAA,HTTPS,65"
  exec: "$forward_main"

If a type is not listed here, match it with its decimal number. If OxiDNS has a built-in name for that type, the mnemonic name is accepted too.