What does Windows error code 9912 (DNS_ERROR_RRL_INVALID_WINDOW_SIZE) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The RRL measurement window is zero or otherwise outside the accepted range.

Previous	Next
DNS_ERROR_RRL_NOT_ENABLED	DNS_ERROR_RRL_INVALID_IPV4_PREFIX

DNS_ERROR_RRL_INVALID_WINDOW_SIZE

What the window controls

DNS_ERROR_RRL_INVALID_WINDOW_SIZE is returned while Windows DNS Server validates an RRL configuration. The affected setting is exposed by PowerShell as WindowInSec and defines the period over which RRL measures and averages a pattern of queries from the same subnet that produce the same response. The protocol specification identifies the underlying field as dwWindowSize and requires Windows to reject an invalid value; the Win32 status text specifically requires a value of at least one second.

The window is not a DNS TTL and does not change zone data or caching. It defines how long the server retains the rate-limiting context for a response pattern. A short window can react to a sharp burst but may be less representative of sustained traffic. A longer window keeps the pattern relevant for longer and can make a broad source-prefix choice more consequential.

How to diagnose the failure

Read the current setting with Get-DnsServerResponseRateLimiting and check the value passed to Set-DnsServerResponseRateLimiting -WindowInSec.
Verify that automation sends a positive integer, not an empty variable, a duration string, or a value in milliseconds. The Windows field is measured in seconds.
Change the window together with the source prefix and response-rate settings only when the expected traffic population is understood. These fields form one policy, not independent tuning knobs.
Use LogOnly to observe the prospective policy before enabling preventive actions on a busy DNS server.

Relationship to other implementations

RRL is an implementation feature rather than a DNS wire-protocol field. BIND documents a rolling window and a token-bucket style account for each response/client grouping. That is useful background for why the parameter exists, but BIND's accepted range and defaults are not a substitute for Windows validation rules.

References

Looking for a different code? Search another status or error code.