TechnitiumSoftware/DnsServer · error · DnsServerException

Cannot add record: disabling records in a signed zones is no

Error message

Cannot add record: disabling records in a signed zones is not supported.

What it means

Thrown by PrimaryZone.AddRecord() on a signed zone when the record being added has its Disabled flag set (record.GetAuthGenericRecordInfo().Disabled == true). A signed zone must sign every record in an RRset; a disabled record would break RRset/NSEC consistency, so disabled records cannot be added to signed zones.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:2632

                    TriggerNotify();
                    break;
            }
        }

        public override bool AddRecord(DnsResourceRecord record)
        {
            if (_dnssecStatus != AuthZoneDnssecStatus.Unsigned)
            {
                switch (record.Type)
                {
                    case DnsResourceRecordType.ANAME:
                    case DnsResourceRecordType.APP:
                        throw new DnsServerException("The record type is not supported by DNSSEC signed primary zones.");

                    default:
                        if (record.GetAuthGenericRecordInfo().Disabled)
                            throw new DnsServerException("Cannot add record: disabling records in a signed zones is not supported.");

                        break;
                }
            }

            switch (record.Type)
            {
                case DnsResourceRecordType.APP:
                    throw new InvalidOperationException("Cannot add record: use SetRecords() for " + record.Type.ToString() + " record");

                case DnsResourceRecordType.DS:
                    throw new InvalidOperationException("Cannot set DS record at zone apex.");

                case DnsResourceRecordType.DNSKEY:
                case DnsResourceRecordType.RRSIG:
                case DnsResourceRecordType.NSEC:
                case DnsResourceRecordType.NSEC3PARAM:
                case DnsResourceRecordType.NSEC3:

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Clear the Disabled flag on the record before adding it to a signed zone, or do not add it.
2. To withdraw a record from a signed zone, omit it; the zone re-signs without it.
3. Validate !Disabled before calling AddRecord on signed zones.

Example fix

// before
zone.AddRecord(record); // throws if record.Disabled

// after
if (!record.GetAuthGenericRecordInfo().Disabled)
    zone.AddRecord(record);

if (IsZoneSigned(zone) && record.GetAuthGenericRecordInfo().Disabled)
    throw new ArgumentException("Disabled records cannot be added to signed zones.");

zone.AddRecord(record);

static bool IsAddableToSignedZone(DnsResourceRecord r) =>
    !r.GetAuthGenericRecordInfo().Disabled;

try { zone.AddRecord(record); }
catch (DnsServerException ex) when (ex.Message.Contains("disabling records in a signed zones"))
{ Log.Error("Clear the Disabled flag before adding to a signed zone."); }

When it happens

Trigger: Calling AddRecord on a signed primary zone with a record whose AuthGenericRecordInfo.Disabled is true.

Common situations: Importing records that were paused/disabled in another server into a signed zone; a UI re-adding a previously disabled record after signing.

Related errors

• Cannot set records: disabling records in a signed zones is n
• The record type is not supported by DNSSEC signed primary zo
• Cannot delete DNSSEC records.
• Cannot update DNSSEC records.
• Cannot update record: disabling records in a signed zones is

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/18c9e514c3060e13. Report an issue: GitHub.