| Previous | Next |
| DNS_ERROR_RRL_INVALID_IPV4_PREFIX | DNS_ERROR_RRL_INVALID_TC_RATE |
DNS_ERROR_RRL_INVALID_IPV6_PREFIX
IPv6 has a separate RRL aggregation boundary
DNS_ERROR_RRL_INVALID_IPV6_PREFIX is a Windows DNS Server validation failure for the RRL IPv6 prefix-length setting. As with IPv4, RRL groups incoming queries by a client subnet before evaluating repeated equivalent responses. The PowerShell setting is IPv6PrefixLength; the documented Windows default is 56, and the Win32 status is used when the supplied prefix is greater than 128.
The field is a number of leading address bits, not an IPv6 literal, a route, or an interface prefix written with a slash. A deployment that passes 2001:db8::/56 where the cmdlet expects the integer 56 has mixed two different representations of the same network concept.
Why the IPv6 value needs independent review
An IPv6 /128 identifies one address, whereas a broader prefix groups multiple addresses into the same RRL accounting population. That choice can matter when users are behind a common access network or when address selection changes over time. It should be based on observed source-address distribution and on the risk model for the DNS service, not copied from the IPv4 setting or assumed from a host's interface configuration.
Checks before changing the value
- Confirm that automation passes a numeric prefix length and that it is no larger than 128.
- Review both IPv4 and IPv6 source populations in logs or packet captures. The two families need not have comparable aggregation behaviour.
- Run RRL in
LogOnlymode when evaluating a new prefix. This preserves normal replies while showing what enforcement would do. - Review the prefix together with the measurement window and response limits; a wider aggregation and a longer window can compound each other.
References
- MS-DNSP: DNS_ERROR_RRL_INVALID_IPV6_PREFIX
- Microsoft: IPv6PrefixLength for Windows RRL
- Knot Resolver: address and prefix rate limiting
Looking for a different code? Search another status or error code.