What does Windows error code 9916 (DNS_ERROR_RRL_INVALID_LEAK_RATE) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The rate for allowing an occasional response to a rate-limited client is invalid.

Previous	Next
DNS_ERROR_RRL_INVALID_TC_RATE	DNS_ERROR_RRL_LEAK_RATE_LESSTHAN_TC_RATE

DNS_ERROR_RRL_INVALID_LEAK_RATE

Leak rate is a controlled exception to dropping

DNS_ERROR_RRL_INVALID_LEAK_RATE means Windows rejected the RRL field called dwLeakRate, exposed by PowerShell as LeakRate. RRL normally restricts repeated responses that match a rate-limited pattern. The leak setting lets the server still answer one of a configured number of queries that would otherwise be dropped. Microsoft documents the supported values as 2 through 10, while zero disables leaking.

That behaviour is deliberately different from TruncateRate. A leak permits an occasional response in the otherwise restricted stream; a truncation sends a response with the DNS TC bit so the client can retry over TCP. Both soften the effect of rate limiting, but they have different network and client-facing consequences.

How to investigate

Confirm that the deployment passes an integer in the documented range, or zero when leaking is intentionally disabled. A value of 1 is not a valid way to mean “allow every request”.
Inspect LeakRate, TruncateRate, ResponsesPerSec, and ErrorsPerSec as one policy. Changing the leak value alone can conceal an unsuitable base rate.
Use Get-DnsServerResponseRateLimiting to check the effective server settings, then use LogOnly when evaluating the impact on legitimate clients sharing a source subnet.
Do not treat leaking as a substitute for fixing spoofed-source exposure, open-recursion policy, or excessive amplification in the served zones.

Why it matters operationally

RRL is intended to reduce amplification while still leaving some path for legitimate traffic. ISC describes analogous RRL implementations as tracking an account per response/client grouping and dropping or truncating replies when the account is negative. The exact counter mechanics are implementation-specific, but the operational trade-off is the same: a more permissive exception can help a real client and can also send more traffic toward a spoofed address.

References

Looking for a different code? Search another status or error code.