/errors/dig/warning-recursion-requested-but-not-available
;; WARNING: recursion requested but not available
- tool
- dig / nslookup
- exit code
- 0
- versions
- BIND 9.x
- os
- linux, macos, windows
;; WARNING: recursion requested but not available means dig asked the server to resolve the name recursively (the RD flag, set by default) and the server answered without the RA flag: it does not offer recursion, at least not to you. You are talking to an authoritative-only server, or to a resolver whose access rules exclude your address. Answers for names in that server's own zones are still correct; for any other name you get no answer or a referral. Query a recursive resolver instead, or add +norecurse when you test an authoritative server on purpose.
Read the flags
dig prints the warning right after the ;; flags: line of the response header when the response has rd set but not ra (the check is in bin/dig/dig.c). Look at that flags: line and at the status: field just above it.
| Flag | Meaning |
|---|---|
| rd | Recursion desired: set by dig unless you pass +norecurse |
| ra | Recursion available: the server will resolve names for you |
| aa | Authoritative answer: the server owns the zone of this name |
| status with the warning | What happened |
|---|---|
| NOERROR with aa | An authoritative server answered for its own zone: the answer is valid |
| NOERROR, no answer, authority records | A referral: the server only points to other name servers |
| REFUSED | The server does not resolve or serve this name for your address |
Commands
dig example.com # your configured resolver
dig @1.1.1.1 example.com # a public recursive resolver
dig @ns1.example.com example.com +norecurse # ask the authoritative server directly
dig example.com +trace # follow the delegation from the rootReplace ns1.example.com with one of the zone's name servers (dig NS example.com +short). With +norecurse dig does not set rd, so the warning does not appear.
On your own BIND resolver
If clients that should use your resolver see this warning, recursion is off or restricted. In named.conf, recursion yes; (the default) and an allow-recursion { ... }; list that includes the client networks control it. Do not allow recursion from the whole Internet: open resolvers are abused for amplification attacks.