What does Windows error code 9911 (DNS_ERROR_RRL_NOT_ENABLED) mean?

 
Previous Next
DNS_ERROR_DP_FSMO_ERROR DNS_ERROR_RRL_INVALID_WINDOW_SIZE

DNS_ERROR_RRL_NOT_ENABLED

RRL is a server-level operating mode

DNS_ERROR_RRL_NOT_ENABLED is not a response code returned to a DNS client. It is a Windows DNS Server management status: the requested RRL-related operation needs Response Rate Limiting to be active, but the server is currently configured with RRL disabled. RRL groups similar replies from a client subnet inside a measurement window and can drop or truncate replies when the configured rate is exceeded. Its purpose is to reduce the usefulness of a DNS server in reflection and amplification attacks.

The mode matters independently of the numeric settings. Windows exposes Enable, Disable, and LogOnly. In LogOnly mode the server performs the calculations and records the actions it would take, but continues to send normal replies instead of dropping or truncating them. That makes it useful for observing the effect of a proposed configuration before enforcement is enabled.

What to check

  • Read the effective server configuration with Get-DnsServerResponseRateLimiting; do not infer RRL state from ordinary DNS query success.
  • Check whether the operation is intended to inspect or change the RRL policy itself, an RRL exception list, or an enforcement-related setting. A DNS zone, client subnet, or DNSSEC setting is a separate feature.
  • Before changing Mode to Enable, review the window, subnet-prefix, response, leak, and truncation settings together. A syntactically valid configuration can still aggregate legitimate users too broadly.
  • Use LogOnly when the production traffic pattern is not known. It distinguishes a configuration issue from the operational question of whether the chosen limit would affect real clients.

Why this is different from the other RRL errors

This code is a prerequisite failure. The nearby DNS_ERROR_RRL_INVALID_* statuses are returned when Windows validates individual fields such as the time window, a source-address prefix length, leak rate, or truncation rate. Correcting one of those values does not itself turn enforcement on.

References

Looking for a different code? Search another status or error code.