DNS 17 BADKEY vs 20 BADNAME
Both DNS 17 (BADKEY) and 20 (BADNAME) belong to the DNS Response Codes (RCODEs) category. 17 indicates that key not recognized. The TSIG key name in the message is not configured on the server. Meanwhile, 20 means that duplicate key name. The key name in a TKEY negotiation is already in use or conflicts with an existing key.
Description
Key not recognized. The TSIG key name in the message is not configured on the server.
When You See It
Your TSIG-signed query or update references a key name that the server does not have in its keyring, so it cannot verify the signature.
How to Fix
Ensure the TSIG key name matches exactly (case-sensitive) on both client and server. Add the missing key to the server's configuration if it is a new key.
Description
Duplicate key name. The key name in a TKEY negotiation is already in use or conflicts with an existing key.
When You See It
A TKEY key establishment failed because a key with the same name already exists on the server from a previous session that was not properly cleaned up.
How to Fix
Use a unique key name for each TKEY session (e.g., append a timestamp or random suffix). Delete stale keys on the server if they are no longer needed.
Key Differences
DNS 17: Key not recognized. The TSIG key name in the message is not configured on the server.
DNS 20: Duplicate key name. The key name in a TKEY negotiation is already in use or conflicts with an existing key.
You encounter 17 when your TSIG-signed query or update references a key name that the server does not have in its keyring, so it cannot verify the signature.
You encounter 20 when a TKEY key establishment failed because a key with the same name already exists on the server from a previous session that was not properly cleaned up.
When to Use Which
For 17 (BADKEY): Ensure the TSIG key name matches exactly (case-sensitive) on both client and server. Add the missing key to the server's configuration if it is a new key. For 20 (BADNAME): Use a unique key name for each TKEY session (e.g., append a timestamp or random suffix). Delete stale keys on the server if they are no longer needed.