DNS 10 NOTZONE vs 18 BADTIME
Both DNS 10 (NOTZONE) and 18 (BADTIME) belong to the DNS Response Codes (RCODEs) category. 10 indicates that name not contained in zone. A name used in the Prerequisite or Update section is not within the zone denoted by the Zone section. Meanwhile, 18 means that signature out of time window. The TSIG signature timestamp is outside the allowed clock skew, indicating a time synchronization issue.
Description
Name not contained in zone. A name used in the Prerequisite or Update section is not within the zone denoted by the Zone section.
When You See It
Your dynamic update tried to modify a record that falls outside the zone specified in the update message (e.g., updating foo.example.org in the example.com zone).
How to Fix
Ensure all names in the update are within the target zone. Check for typos in the zone name or the records being updated.
Description
Signature out of time window. The TSIG signature timestamp is outside the allowed clock skew, indicating a time synchronization issue.
When You See It
The clocks on the DNS client and server are too far apart (usually more than 5 minutes), causing TSIG signature validation to fail.
How to Fix
Synchronize clocks on both machines using NTP. Check that the TSIG fudge value (allowed skew) is reasonable — the default 300 seconds is usually sufficient.
Key Differences
DNS 10: Name not contained in zone. A name used in the Prerequisite or Update section is not within the zone denoted by the Zone section.
DNS 18: Signature out of time window. The TSIG signature timestamp is outside the allowed clock skew, indicating a time synchronization issue.
You encounter 10 when your dynamic update tried to modify a record that falls outside the zone specified in the update message (e.g., updating foo.example.org in the example.com zone).
You encounter 18 when the clocks on the DNS client and server are too far apart (usually more than 5 minutes), causing TSIG signature validation to fail.
When to Use Which
For 10 (NOTZONE): Ensure all names in the update are within the target zone. Check for typos in the zone name or the records being updated. For 18 (BADTIME): Synchronize clocks on both machines using NTP. Check that the TSIG fudge value (allowed skew) is reasonable — the default 300 seconds is usually sufficient.