Windows error 9505 (DNS_ERROR_UNSECURE

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A DNS response did not satisfy the security validation required for the queried namespace.

Previous	Next
DNS_ERROR_RCODE	DNS_REQUEST_PENDING

DNS_ERROR_UNSECURE_PACKET

Security policy rejected the answer

DNS_ERROR_UNSECURE_PACKET should be investigated in the context of DNS security policy, especially DNSSEC requirements selected through the Windows Name Resolution Policy Table (NRPT). The DNS Client service evaluates NRPT before sending a matching query, and a rule can require validated name and address data for a namespace. A syntactically correct DNS answer can therefore be unusable when the required chain of trust is absent or validation fails.

The AD flag in one packet is not, by itself, a complete independent proof for application diagnostics. Validation depends on the resolver path, trust anchors, signatures, delegation records, algorithm support, and time validity. Disabling the policy may hide the symptom while removing the protection that produced the error.

What to inspect

Show the effective NRPT rule for the queried FQDN and whether DNSSEC validation is required.
Check the signed delegation chain, DS and DNSKEY records, RRSIG validity, trust anchors, and system time.
Compare results from the configured validating resolver and the authoritative servers.
Correct the broken signature, delegation, trust, or forwarding path before considering a policy exception.

References

Looking for a different code? Search another status or error code.