What is EDE?

EDE (Extended DNS Errors) is an EDNS option, defined in RFC 8914, that lets a DNS server explain why a query failed, alongside codes like SERVFAIL.

Classic DNS response codes are blunt. SERVFAIL in particular covers everything from an unreachable nameserver to a forged signature. EDE adds an EDNS option (option code 15) to the response, carrying a 16-bit info code and an optional free-text explanation. It doesn't change the response code and only adds detail. Some of the codes you'll see most:

• 6 DNSSEC Bogus, 7 Signature Expired, 9 DNSKEY Missing and 10 RRSIGs Missing: kinds of DNSSEC validation failure.
• 3 Stale Answer: the resolver served expired cached data because it couldn't refresh it.
• 15 Blocked, 17 Filtered and 18 Prohibited: the resolver's policy stopped the query.
• 22 No Reachable Authority: none of the authoritative servers answered.
• 23 Network Error: a lower-level failure reaching them.

EDE isn't limited to errors. It can come with a NOERROR answer too, for example to flag a stale answer.

To see EDE, the client has to send EDNS, which modern dig does by default. It prints the codes in the OPT pseudosection as a line such as ; EDE: 9 (DNSKEY Missing). Recent versions of BIND, Unbound, Knot Resolver and the PowerDNS Recursor all send them. Most applications and stub resolvers ignore EDE, so it's a troubleshooting aid for people rather than something software acts on. It isn't authenticated, so treat it as a hint. It's still the fastest way to tell a DNSSEC problem from a reachability one. In the PowerDNS on Debian lesson, codes 9, 10 and 22 each point straight at the cause of a SERVFAIL.