TechnitiumSoftware/DnsServer · error · DnsServerException

Cannot add record: disabling records in a signed zones is no

Error message

Cannot add record: disabling records in a signed zones is not supported.

What it means

Thrown by PrimarySubDomainZone.AddRecord() inside the DNSSEC guard when record.GetAuthGenericRecordInfo().Disabled == true and the parent zone is signed. Same rule as error 491 but on the single-record AddRecord path: a disabled record inside a signed RRset would desync the DNSSEC signatures, so the add is rejected before writing. DnsServerException, catchable.

Source

Thrown at DnsServerCore/Dns/Zones/PrimarySubDomainZone.cs:121

                    _primaryZone.TriggerNotify();
                    break;
            }
        }

        public override bool AddRecord(DnsResourceRecord record)
        {
            if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)
            {
                switch (record.Type)
                {
                    case DnsResourceRecordType.ANAME:
                    case DnsResourceRecordType.APP:
                        throw new DnsServerException("The record type is not supported by DNSSEC signed primary zones.");

                    default:
                        if (record.GetAuthGenericRecordInfo().Disabled)
                            throw new DnsServerException("Cannot add record: disabling records in a signed zones is not supported.");

                        break;
                }
            }

            switch (record.Type)
            {
                case DnsResourceRecordType.DNSKEY:
                case DnsResourceRecordType.RRSIG:
                case DnsResourceRecordType.NSEC:
                case DnsResourceRecordType.NSEC3PARAM:
                case DnsResourceRecordType.NSEC3:
                    throw new InvalidOperationException("Cannot add DNSSEC record.");

                case DnsResourceRecordType.FWD:
                    throw new DnsServerException("The record type is not supported by primary zones.");

                default:

View on GitHub (pinned to d0484b6c1e)

Solutions

Do not mark records Disabled in a signed zone; add them active or omit them.
Set record.GetAuthGenericRecordInfo().Disabled = false before AddRecord when the zone is signed.
For staged rollout on signed zones, add/remove records rather than toggling Disabled.

Example fix

// before
record.GetAuthGenericRecordInfo().Disabled = true;
zone.AddRecord(record);

// after (signed zone)
record.GetAuthGenericRecordInfo().Disabled = false;
zone.AddRecord(record);

Defensive patterns

Strategy: validation

Validate before calling

if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)
    record.GetAuthGenericRecordInfo().Disabled = false;
zone.AddRecord(record);

Type guard

static bool IsAddableInSignedZone(DnsResourceRecord r, AuthZoneDnssecStatus s) => s == AuthZoneDnssecStatus.Unsigned || !r.GetAuthGenericRecordInfo().Disabled;

Try / catch

try { zone.AddRecord(record); }
catch (DnsServerException ex) when (ex.Message.Contains("disabling records")) { record.GetAuthGenericRecordInfo().Disabled = false; zone.AddRecord(record); }

Prevention

Never construct new records with Disabled=true for a signed zone.
Add/remove records to stage rollouts on signed zones instead of toggling Disabled.
Validate !Disabled before AddRecord when the zone is signed.

When it happens

Trigger: zone.AddRecord(record) on a signed PrimarySubDomainZone where record was constructed/marked Disabled=true (parked/staged record).

Common situations: Pre-disabling records for staged rollout; importing a 'parked' record set into a signed zone; client code that defaults new records to Disabled.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/af2393bcb0bc866e. Report an issue: GitHub.