17
DNS
17 BADKEY
Key not recognized. The TSIG key name in the message is not configured on the server.
On this page
When You See This Code
Your TSIG-signed query or update references a key name that the server does not have in its keyring, so it cannot verify the signature.
How to Fix
Ensure the TSIG key name matches exactly (case-sensitive) on both client and server. Add the missing key to the server's configuration if it is a new key.
Specification
Compare With
Guides
HTTP Request Lifecycle: From URL to Response
HTTP Fundamentals
Step-by-Step DNS Troubleshooting with dig and nslookup
Debugging & Troubleshooting
Improving Email Deliverability: SPF, DKIM, and DMARC Setup
Email Delivery
DNS Response Codes (RCODEs) Explained
DNS & Networking
DNS TTL: How to Set TTL Values and Avoid Propagation Delays
DNS & Networking
DNS Propagation: Why Changes Take Time
DNS & Networking
DNSSEC Implementation Guide
DNS & Networking
DNS-Based Failover and High Availability
DNS & Networking
DNS Record Types Explained: A, AAAA, CNAME, MX, TXT, and Beyond
DNS & Networking
DNS over HTTPS (DoH) and DNS over TLS (DoT): Encrypted DNS Explained
DNS & Networking
Essential Network Debugging Tools: ping, traceroute, mtr, and tcpdump
DNS & Networking
Resource Hints: Preload, Prefetch, Preconnect, and DNS-Prefetch
Performance & Optimization
RFC 9114: HTTP/3 Protocol Deep Dive
Protocol Deep Dives
RFC 3261: SIP Protocol Deep Dive
Protocol Deep Dives
QUIC Protocol: The Transport Layer Behind HTTP/3
Protocol Deep Dives
Migrating from TLS 1.2 to TLS 1.3: Configuration and Compatibility
Migration & Upgrades
Secret Management for API Keys, Tokens, and Certificates
Production Infrastructure
Glossary
TCP/IP
Port Number
Latency
Timeout
Firewall
DNS over HTTPS (DoH)
IPv6
Subnet (Subnetwork)
MTU (Maximum Transmission Unit)
UDP (User Datagram Protocol)
DNS Lookup
CDN (Content Delivery Network)
Request-Response Model
RFC (Request for Comments)
IANA (Internet Assigned Numbers Authority)
Wire Format
Extension Mechanism
Connectionless
Text vs Binary Protocol
DNS Resolution
DNS Record Types
TTL (Time to Live)
DNSSEC (DNS Security Extensions)
DNS over TLS (DoT)
Anycast
Recursive Resolver
Authoritative Name Server
Glue Record
EDNS(0)
DNS Zone
DNS Propagation
CNAME Record
MX Record
SRV Record
PTR Record
DNS Cache Poisoning
DNS Root Server
Split-Horizon DNS
Wildcard DNS Record
SPF, DKIM, and DMARC
Email Deliverability
MTA (Mail Transfer Agent)
ARC (Authenticated Received Chain)
BIMI (Brand Indicators for Message Identification)
Service Discovery
GSLB (Global Server Load Balancing)
Failover
Active-Passive HA
Frequently Asked Questions
What is DNS 17 BADKEY?
Key not recognized. The TSIG key name in the message is not configured on the server.
When do you see DNS 17 BADKEY?
Your TSIG-signed query or update references a key name that the server does not have in its keyring, so it cannot verify the signature.
How to fix DNS 17 BADKEY?
Ensure the TSIG key name matches exactly (case-sensitive) on both client and server. Add the missing key to the server's configuration if it is a new key.