DNS 16 BADVERS/BADSIG vs 22 BADTRUNC
Both DNS 16 (BADVERS/BADSIG) and 22 (BADTRUNC) belong to the DNS Response Codes (RCODEs) category. 16 indicates that bad OPT Version or TSIG Signature Failure. Either the EDNS version in the OPT record is not supported, or the TSIG signature on the message failed verification. Meanwhile, 22 means that bad truncation. The TSIG record was truncated in a way that makes it impossible to verify the message signature.
Description
Bad OPT Version or TSIG Signature Failure. Either the EDNS version in the OPT record is not supported, or the TSIG signature on the message failed verification.
When You See It
As BADVERS: your client sent an EDNS version higher than the server supports. As BADSIG: the TSIG MAC on the message did not match, indicating a shared-secret mismatch or message tampering.
How to Fix
For BADVERS, downgrade the EDNS version (most servers support version 0 only). For BADSIG, regenerate and re-synchronize the TSIG shared secret on both endpoints.
Description
Bad truncation. The TSIG record was truncated in a way that makes it impossible to verify the message signature.
When You See It
A large DNS response was truncated (TC bit set) but the TSIG MAC was computed over the full message, making the truncated version unverifiable.
How to Fix
Retry the query over TCP to avoid truncation. If using UDP, ensure your EDNS buffer size is large enough to receive the full signed response.
Key Differences
DNS 16: Bad OPT Version or TSIG Signature Failure. Either the EDNS version in the OPT record is not supported, or the TSIG signature on the message failed verification.
DNS 22: Bad truncation. The TSIG record was truncated in a way that makes it impossible to verify the message signature.
You encounter 16 when as BADVERS: your client sent an EDNS version higher than the server supports. As BADSIG: the TSIG MAC on the message did not match, indicating a shared-secret mismatch or message tampering.
You encounter 22 when a large DNS response was truncated (TC bit set) but the TSIG MAC was computed over the full message, making the truncated version unverifiable.
When to Use Which
For 16 (BADVERS/BADSIG): For BADVERS, downgrade the EDNS version (most servers support version 0 only). For BADSIG, regenerate and re-synchronize the TSIG shared secret on both endpoints. For 22 (BADTRUNC): Retry the query over TCP to avoid truncation. If using UDP, ensure your EDNS buffer size is large enough to receive the full signed response.