What does Windows error code 9917 (DNS_ERROR_RRL_LEAK_RATE_LESSTHAN_TC_RATE) mean?

 
Previous Next
DNS_ERROR_RRL_INVALID_LEAK_RATE DNS_ERROR_VIRTUALIZATION_INSTANCE_ALREADY_EXISTS

DNS_ERROR_RRL_LEAK_RATE_LESSTHAN_TC_RATE

This is a relationship error, not a range error

DNS_ERROR_RRL_LEAK_RATE_LESSTHAN_TC_RATE is raised after Windows has considered two RRL fields together. The DNS Server protocol specifies this status when dwLeakRate is lower than dwTCRate and neither field is zero. The individual numbers may therefore look valid on their own, yet their combination is rejected. In PowerShell terms, the fields are LeakRate and TruncateRate.

The two values describe different exceptions for traffic that RRL would otherwise suppress. LeakRate allows an occasional response, while TruncateRate periodically sends a response with the DNS TC flag so a client can retry using TCP. A smaller divisor means the corresponding event happens more often. Keeping the leak rate above the truncation rate when both are active avoids making ordinary leaked responses more frequent than the TCP-retry signal.

What to verify

  • Read both effective values with Get-DnsServerResponseRateLimiting; do not diagnose this error by changing only the field mentioned last in a deployment script.
  • Check whether either exception is actually needed. Windows documents zero as a way to disable leaking or truncated-response behaviour, while the nonzero choices must still satisfy the pairwise validation rule.
  • Test the complete policy in LogOnly mode. A syntactically acceptable pair can still be too permissive or too aggressive for clients that share a source prefix.
  • Confirm DNS over TCP works end to end before depending on the truncation path for legitimate clients.

Do not confuse it with similar statuses

DNS_ERROR_RRL_INVALID_LEAK_RATE and DNS_ERROR_RRL_INVALID_TC_RATE mean one field itself is outside the accepted value set. This status instead means the server rejected the relationship between two nonzero values. It is therefore expected only when both controls are being configured or validated together.

References

Looking for a different code? Search another status or error code.