DNS

18 BADTIME

Signature out of time window. The TSIG signature timestamp is outside the allowed clock skew, indicating a time synchronization issue.

On this page

When You See This Code

The clocks on the DNS client and server are too far apart (usually more than 5 minutes), causing TSIG signature validation to fail.

How to Fix

Synchronize clocks on both machines using NTP. Check that the TSIG fudge value (allowed skew) is reasonable — the default 300 seconds is usually sufficient.

Specification

View RFC / Specification →

Compare With

0 NOERROR 1 FORMERR 2 SERVFAIL 3 NXDOMAIN 4 NOTIMP 5 REFUSED 6 YXDOMAIN 7 YXRRSET 8 NXRRSET 9 NOTAUTH 10 NOTZONE 11 DSOTYPENI

Guides

HTTP Request Lifecycle: From URL to Response HTTP Fundamentals

Step-by-Step DNS Troubleshooting with dig and nslookup Debugging & Troubleshooting

Improving Email Deliverability: SPF, DKIM, and DMARC Setup Email Delivery

DNS Response Codes (RCODEs) Explained DNS & Networking

DNS TTL: How to Set TTL Values and Avoid Propagation Delays DNS & Networking

DNS Propagation: Why Changes Take Time DNS & Networking

DNSSEC Implementation Guide DNS & Networking

DNS-Based Failover and High Availability DNS & Networking

DNS Record Types Explained: A, AAAA, CNAME, MX, TXT, and Beyond DNS & Networking

DNS over HTTPS (DoH) and DNS over TLS (DoT): Encrypted DNS Explained DNS & Networking

Essential Network Debugging Tools: ping, traceroute, mtr, and tcpdump DNS & Networking

Resource Hints: Preload, Prefetch, Preconnect, and DNS-Prefetch Performance & Optimization

RFC 9114: HTTP/3 Protocol Deep Dive Protocol Deep Dives

RFC 3261: SIP Protocol Deep Dive Protocol Deep Dives

QUIC Protocol: The Transport Layer Behind HTTP/3 Protocol Deep Dives

Migrating from TLS 1.2 to TLS 1.3: Configuration and Compatibility Migration & Upgrades

Secret Management for API Keys, Tokens, and Certificates Production Infrastructure

Glossary

TCP/IP Port Number Latency Timeout Firewall DNS over HTTPS (DoH) IPv6 Subnet (Subnetwork) MTU (Maximum Transmission Unit) UDP (User Datagram Protocol) DNS Lookup CDN (Content Delivery Network) Request-Response Model RFC (Request for Comments) IANA (Internet Assigned Numbers Authority) Wire Format Extension Mechanism Connectionless Text vs Binary Protocol DNS Resolution DNS Record Types TTL (Time to Live) DNSSEC (DNS Security Extensions) DNS over TLS (DoT) Anycast Recursive Resolver Authoritative Name Server Glue Record EDNS(0) DNS Zone DNS Propagation CNAME Record MX Record SRV Record PTR Record DNS Cache Poisoning DNS Root Server Split-Horizon DNS Wildcard DNS Record SPF, DKIM, and DMARC Email Deliverability MTA (Mail Transfer Agent) ARC (Authenticated Received Chain) BIMI (Brand Indicators for Message Identification) Service Discovery GSLB (Global Server Load Balancing) Failover Active-Passive HA

Frequently Asked Questions

What is DNS 18 BADTIME?

Signature out of time window. The TSIG signature timestamp is outside the allowed clock skew, indicating a time synchronization issue.

When do you see DNS 18 BADTIME?

The clocks on the DNS client and server are too far apart (usually more than 5 minutes), causing TSIG signature validation to fail.

How to fix DNS 18 BADTIME?

Synchronize clocks on both machines using NTP. Check that the TSIG fudge value (allowed skew) is reasonable — the default 300 seconds is usually sufficient.