TechnitiumSoftware/DnsServer · error · DnsServerException

Cannot delete private key: no such private key was found.

Error message

Cannot delete private key: no such private key was found.

What it means

Thrown by DeletePrivateKey when _dnssecPrivateKeys.TryGetValue fails for the supplied keyTag. You cannot delete a key the zone does not hold.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:1096

            {
                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out DnssecPrivateKey privateKey))
                    throw new DnsServerException("Cannot update private key: no such private key was found.");

                privateKey.RolloverDays = rolloverDays;

                return privateKey;
            }
        }

        public void DeletePrivateKey(ushort keyTag)
        {
            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)
                throw new DnsServerException("The zone must be signed.");

            lock (_dnssecPrivateKeys)
            {
                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out DnssecPrivateKey privateKey))
                    throw new DnsServerException("Cannot delete private key: no such private key was found.");

                if (privateKey.State != DnssecPrivateKeyState.Generated)
                    throw new DnsServerException("Cannot delete private key: only keys with Generated state can be deleted.");

                _dnssecPrivateKeys.Remove(keyTag);
            }
        }

        public void PublishAllGeneratedKeys()
        {
            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)
                throw new DnsServerException("The zone must be signed.");

            List<DnssecPrivateKey> generatedPrivateKeys = new List<DnssecPrivateKey>();
            List<DnsResourceRecord> newDnsKeyRecords = new List<DnsResourceRecord>();

            uint dnsKeyTtl = GetDnsKeyTtl();

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Verify the keyTag exists in zone.DnssecPrivateKeys before deleting.
2. Treat an absent keyTag as already-deleted if idempotency is desired (guard, don't call).
3. Refresh your key listing before acting on a user-supplied tag.

Example fix

// before
zone.DeletePrivateKey(keyTag);

// after
var keys = zone.DnssecPrivateKeys;
if (keys.Any(k => k.KeyTag == keyTag))
    zone.DeletePrivateKey(keyTag);
else
    Console.WriteLine($"KeyTag {keyTag} not present; already deleted.");

// Confirm the keyTag exists before deleting
if (zone.DnssecPrivateKeys.Any(k => k.KeyTag == keyTag))
    zone.DeletePrivateKey(keyTag);

static bool KeyTagExists(ApexZone zone, ushort keyTag) =>
    zone.DnssecPrivateKeys.Any(k => k.KeyTag == keyTag);

try
{
    zone.DeletePrivateKey(keyTag);
}
catch (DnsServerException ex) when (ex.Message.Contains("no such private key was found"))
{
    // key already gone; treat as success for idempotent cleanup
}

When it happens

Trigger: Calling DeletePrivateKey with a keyTag absent from the zone's private key set.

Common situations: Retrying a delete after the key was already removed, or using a keyTag copied from a different zone.

Related errors

• The primary zone must be signed.
• Failed to add {(privateKey.KeyType == DnssecPrivateKeyType.K
• Cannot update private key: no such private key was found.
• The zone must be signed.
• Cannot delete private key: only keys with Generated state ca

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/4c1023966a88f1ec. Report an issue: GitHub.