Windows error 9502 (DNS_ERROR_BAD_PACKET): meaning and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: Windows DNS rejected a received or supplied DNS message as malformed or internally inconsistent.

Previous	Next
DNS_INFO_NO_RECORDS	DNS_ERROR_NO_PACKET

DNS_ERROR_BAD_PACKET

A wire-format or parser failure

DNS_ERROR_BAD_PACKET indicates that the DNS message could not be accepted as a valid packet. DNS uses compact binary sections whose counts, variable-length RDATA fields, and compressed names must all fit within the actual message. A truncated datagram, invalid compression pointer, impossible section count, malformed EDNS option, or incorrect TCP length framing can make the packet unparsable before its records are useful.

This status is different from DNS_ERROR_RCODE. An RCODE is a structured server response in a packet that was parsed; a bad packet prevents reliable interpretation of that response.

What to capture

Preserve the exact packet bytes and transport metadata before another retry replaces the evidence.
Compare the DNS header counts with the number and boundaries of question, answer, authority, and additional records.
For UDP, check truncation and the TC bit; for TCP, verify the two-octet message length and stream reassembly.
Test without middleboxes that rewrite DNS, but do not assume the authoritative server is at fault until the source address and transaction ID are verified.

References

Looking for a different code? Search another status or error code.