TechnitiumSoftware/DnsServer · error · DnsServerException

Cannot publish DNSKEY: no generated private keys were found.

Error message

Cannot publish DNSKEY: no generated private keys were found.

What it means

Thrown by PublishAllGeneratedKeys when no private keys are in the Generated state. The method scans the key store for Generated keys to publish; if all keys are already Published/Ready/Active/etc., there is nothing to do and the library treats it as an error.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:1130

            uint dnsKeyTtl = GetDnsKeyTtl();

            lock (_dnssecPrivateKeys)
            {
                foreach (KeyValuePair<ushort, DnssecPrivateKey> privateKeyEntry in _dnssecPrivateKeys)
                {
                    DnssecPrivateKey privateKey = privateKeyEntry.Value;

                    if (privateKey.State == DnssecPrivateKeyState.Generated)
                    {
                        generatedPrivateKeys.Add(privateKey);
                        newDnsKeyRecords.Add(new DnsResourceRecord(_name, DnsResourceRecordType.DNSKEY, DnsClass.IN, dnsKeyTtl, privateKey.DnsKey));
                    }
                }
            }

            if (generatedPrivateKeys.Count == 0)
                throw new DnsServerException("Cannot publish DNSKEY: no generated private keys were found.");

            IReadOnlyList<DnsResourceRecord> dnsKeyRecords = _entries.AddOrUpdate(DnsResourceRecordType.DNSKEY, delegate (DnsResourceRecordType key)
            {
                return newDnsKeyRecords;
            },
            delegate (DnsResourceRecordType key, IReadOnlyList<DnsResourceRecord> existingRecords)
            {
                foreach (DnsResourceRecord existingRecord in existingRecords)
                {
                    foreach (DnsResourceRecord newDnsKeyRecord in newDnsKeyRecords)
                    {
                        if (existingRecord.Equals(newDnsKeyRecord))
                            throw new DnsServerException("Cannot publish DNSKEY: the key is already published.");
                    }
                }

                List<DnsResourceRecord> dnsKeyRecords = new List<DnsResourceRecord>(existingRecords.Count + newDnsKeyRecords.Count);

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Generate keys first with GenerateAndAddPrivateKey so at least one is in Generated state.
2. Before publishing, check whether any DnssecPrivateKeys entry has State == Generated; if none, skip the publish call.
3. Make publish idempotent by treating 'no Generated keys' as a no-op rather than an error.

Example fix

// before
zone.PublishAllGeneratedKeys();

// after
bool anyGenerated = zone.DnssecPrivateKeys.Any(k => k.State == DnssecPrivateKeyState.Generated);
if (anyGenerated)
    zone.PublishAllGeneratedKeys();

// Only publish when at least one Generated key exists
bool anyGenerated = zone.DnssecPrivateKeys
    .Any(k => k.State == DnssecPrivateKeyState.Generated);
if (anyGenerated)
    zone.PublishAllGeneratedKeys();

static bool HasGeneratedKeys(ApexZone zone) =>
    zone.DnssecPrivateKeys.Any(k => k.State == DnssecPrivateKeyState.Generated);

try
{
    zone.PublishAllGeneratedKeys();
}
catch (DnsServerException ex) when (ex.Message.Contains("no generated private keys were found"))
{
    // nothing to publish; treat as no-op
}

When it happens

Trigger: Calling PublishAllGeneratedKeys when every private key on the zone has a State other than Generated.

Common situations: Calling publish twice in a row (the second call finds nothing Generated), or calling publish before GenerateAndAddPrivateKey has created any keys.

Related errors

• Cannot delete private key: only keys with Generated state ca
• Cannot publish DNSKEY: the key is already published.
• The primary zone must be signed.
• Failed to add {(privateKey.KeyType == DnssecPrivateKeyType.K
• Cannot update private key: no such private key was found.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/872106c1ba03efac. Report an issue: GitHub.