| Previous | Next |
| DNS_ERROR_RRL_INVALID_WINDOW_SIZE | DNS_ERROR_RRL_INVALID_IPV6_PREFIX |
DNS_ERROR_RRL_INVALID_IPV4_PREFIX
RRL groups clients by an IPv4 prefix
DNS_ERROR_RRL_INVALID_IPV4_PREFIX identifies an invalid value for the Windows RRL IPv4 prefix-length field. RRL does not necessarily account for each source address independently: Windows groups incoming queries into an IPv4 subnet before deciding whether repeated equivalent responses occur too frequently. The IPv4PrefixLength parameter therefore changes the population that shares an RRL counter. The documented default is 24; Windows rejects a prefix length greater than 32.
This is a prefix length, not an IPv4 address and not a dotted subnet mask. Supplying 255.255.255.0, an address such as 192.0.2.0, or a value calculated in the wrong unit is a configuration-input error rather than an RRL decision about a DNS request.
Why prefix selection affects real users
A longer prefix groups fewer source addresses, while a shorter prefix makes more hosts share the same accounting bucket. Neither extreme is universally correct. Too broad an aggregation can rate-limit independent clients behind NAT, a campus network, or a provider edge; too narrow an aggregation can reduce the protection against traffic distributed across many addresses within one network. The right value depends on who sends queries to the server and how their source addresses appear at the authoritative or recursive DNS service.
Useful checks
- Inspect the value emitted by the deployment tool before it reaches
Set-DnsServerResponseRateLimiting. - Compare it with
Get-DnsServerResponseRateLimiting, then test the prospective policy inLogOnlymode. - Do not copy the prefix from an interface address or routing configuration automatically. RRL aggregation describes the client population seen by DNS, not the server's own subnet.
- Review
IPv6PrefixLengthseparately. Windows uses a different default for IPv6, and an IPv4 choice cannot be transferred mechanically.
References
- MS-DNSP: DNS_ERROR_RRL_INVALID_IPV4_PREFIX
- Microsoft: IPv4PrefixLength for Windows RRL
- BIND 9 reference: client address-block grouping
Looking for a different code? Search another status or error code.