> Source: [sk31719](https://support.checkpoint.com/results/sk/sk31719)

# sk31719 - DNS Attack Info: "Bad resource record format, illegal RR type in query"

| Property | Value |
|----------|-------|
| Solution ID | sk31719 |
| Date Created | 2006-04-26 |
| Last Modified | 2015-09-01 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Error in SmartView Tracker: "Bad resource record format, illegal RR type in query".
* Error in SmartView Tracker: "Invalid DNS".

## Solution

Resource records are the basic units of data in DNS. They define some attribute for a domain name, such as an IP address or mail route.   
Resource records generally consist of five main components: domain name, TTL, class, type, and the record data. The "type" is a 16 bit unsigned number that indicates the type of the record.   

This message is generated if while parsing a resource record the type was found to be illegal. Possible scenarios are that the type is zero or out of the allowed range, if a TKEY resource record has type other than TKEY (see RFC 2930).   
Another scenario is if the message is a query but not an IXFR query. IXFR is a mechanism for a partial transfer of the entire zone database (RFC 1995).   
Only the IXFR query packet can contain resource records in the authority section (the SOA record of client's version of the zone).   

To summarize, the error is displayed and packets are dropped because they do not comply with the protocol. It may indicate a malicious attempt to attack the system.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content