While helping to diagnose name resolution issues on a Windows Domain, I discovered that Microsoft DNS Server (version 1DB10106 (6.1 build 7601)) responds to requests from the BIND DIG tool (version 9.11) with response code 1 FORMERR (Request format error). This post discusses why and a workaround.

First, an example request and response, to clarify the issue:

; <<>> DiG 9.11.0 <<>> kevinlocke.name @
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: FORMERR, id: 59675
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 808a22be618a7750 (echoed)
;kevinlocke.name.			IN	A

;; Query time: 62 msec
;; WHEN: Fri Jan 20 17:24:10 Mountain Daylight Time 2017
;; MSG SIZE  rcvd: 51

DIG requested kevinlocke.name and received FORMERR. After some trial and error, I determined that the issue results from DIG 9.11 sending the DNS COOKIE option. This option was enabled by default in BIND 9.11. Unfortunately, adding this option causes DNS Server to treat the request as malformed. This behavior appears to violate “Any OPTION-CODE values not understood by a responder or requestor MUST be ignored.” from Section 6.1.2 of RFC 6891, but that is of small consolation for a non-working system.

As a workaround, pass the +nocookie option (or +noedns to disable all EDNS options) as in dig +nocookie kevinlocke.name.