19
DNS
19 BADMODE
Bad TKEY Mode. The TKEY mode field contains a value not supported by the server.
On this page
When You See This Code
Your client attempted a TKEY key exchange using a mode (e.g., Diffie-Hellman, GSS-API) that the server does not support or has not been configured for.
How to Fix
Check which TKEY modes the server supports and configure your client to use a compatible mode. GSS-TSIG (mode 3) is the most widely deployed.
Specification
Compare With
Guides
HTTP Request Lifecycle: From URL to Response
HTTP Fundamentals
Step-by-Step DNS Troubleshooting with dig and nslookup
Debugging & Troubleshooting
Improving Email Deliverability: SPF, DKIM, and DMARC Setup
Email Delivery
DNS Response Codes (RCODEs) Explained
DNS & Networking
DNS TTL: How to Set TTL Values and Avoid Propagation Delays
DNS & Networking
DNS Propagation: Why Changes Take Time
DNS & Networking
DNSSEC Implementation Guide
DNS & Networking
DNS-Based Failover and High Availability
DNS & Networking
DNS Record Types Explained: A, AAAA, CNAME, MX, TXT, and Beyond
DNS & Networking
DNS over HTTPS (DoH) and DNS over TLS (DoT): Encrypted DNS Explained
DNS & Networking
Essential Network Debugging Tools: ping, traceroute, mtr, and tcpdump
DNS & Networking
Resource Hints: Preload, Prefetch, Preconnect, and DNS-Prefetch
Performance & Optimization
RFC 9114: HTTP/3 Protocol Deep Dive
Protocol Deep Dives
RFC 3261: SIP Protocol Deep Dive
Protocol Deep Dives
QUIC Protocol: The Transport Layer Behind HTTP/3
Protocol Deep Dives
Migrating from TLS 1.2 to TLS 1.3: Configuration and Compatibility
Migration & Upgrades
Secret Management for API Keys, Tokens, and Certificates
Production Infrastructure
Glossary
TCP/IP
Port Number
Latency
Timeout
Firewall
DNS over HTTPS (DoH)
IPv6
Subnet (Subnetwork)
MTU (Maximum Transmission Unit)
UDP (User Datagram Protocol)
DNS Lookup
CDN (Content Delivery Network)
Request-Response Model
RFC (Request for Comments)
IANA (Internet Assigned Numbers Authority)
Wire Format
Extension Mechanism
Connectionless
Text vs Binary Protocol
DNS Resolution
DNS Record Types
TTL (Time to Live)
DNSSEC (DNS Security Extensions)
DNS over TLS (DoT)
Anycast
Recursive Resolver
Authoritative Name Server
Glue Record
EDNS(0)
DNS Zone
DNS Propagation
CNAME Record
MX Record
SRV Record
PTR Record
DNS Cache Poisoning
DNS Root Server
Split-Horizon DNS
Wildcard DNS Record
SPF, DKIM, and DMARC
Email Deliverability
MTA (Mail Transfer Agent)
ARC (Authenticated Received Chain)
BIMI (Brand Indicators for Message Identification)
Service Discovery
GSLB (Global Server Load Balancing)
Failover
Active-Passive HA
Frequently Asked Questions
What is DNS 19 BADMODE?
Bad TKEY Mode. The TKEY mode field contains a value not supported by the server.
When do you see DNS 19 BADMODE?
Your client attempted a TKEY key exchange using a mode (e.g., Diffie-Hellman, GSS-API) that the server does not support or has not been configured for.
How to fix DNS 19 BADMODE?
Check which TKEY modes the server supports and configure your client to use a compatible mode. GSS-TSIG (mode 3) is the most widely deployed.