TechnitiumSoftware/DnsServer · error · InvalidOperationException

Cannot set DNSSEC records.

Error message

Cannot set DNSSEC records.

What it means

Thrown as InvalidOperationException by PrimaryZone.SetRecords() when the requested type is any DNSSEC record type (DNSKEY, RRSIG, NSEC, NSEC3PARAM, NSEC3). These records are generated and maintained exclusively by the DNSSEC signing engine; setting them manually would corrupt the signature chain. This is a programming/usage error.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:2598

                            case AuthZoneDnssecStatus.SignedWithNSEC:
                                RefreshNSec();
                                break;

                            case AuthZoneDnssecStatus.SignedWithNSEC3:
                                RefreshNSec3();
                                break;
                        }
                    }

                    TriggerNotify();
                    break;

                case DnsResourceRecordType.DNSKEY:
                case DnsResourceRecordType.RRSIG:
                case DnsResourceRecordType.NSEC:
                case DnsResourceRecordType.NSEC3PARAM:
                case DnsResourceRecordType.NSEC3:
                    throw new InvalidOperationException("Cannot set DNSSEC records.");

                case DnsResourceRecordType.FWD:
                    throw new DnsServerException("The record type is not supported by primary zones.");

                default:
                    if (records[0].OriginalTtlValue > GetZoneSoaExpire())
                        throw new DnsServerException("Cannot set records: TTL cannot be greater than SOA EXPIRE.");

                    if (!TrySetRecords(type, records, out IReadOnlyList<DnsResourceRecord> deletedRecords))
                        throw new DnsServerException("Cannot set records. Please try again.");

                    CommitAndIncrementSerial(deletedRecords, records);

                    if (_dnssecStatus != AuthZoneDnssecStatus.Unsigned)
                        UpdateDnssecRecordsFor(this, type);

                    TriggerNotify();
                    break;

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Never call SetRecords with DNSSEC record types; let the signing engine produce them via the DNSSEC sign/refresh APIs.
2. Filter DNSKEY/RRSIG/NSEC/NSEC3PARAM/NSEC3 out of any record set before calling SetRecords.
3. To change DNSKEY TTL use UpdateDnsKeyTtl; to (re)sign the zone use the DNSSEC signing flow.

Example fix

// before
zone.SetRecords(type, records); // throws for DNSSEC types

// after
var userManaged = records.Where(r => !IsDnssecType(r.Type)).ToList();
zone.SetRecords(type, userManaged);
// bool IsDnssecType(DnsResourceRecordType t) => t == DNSKEY || t == RRSIG || t == NSEC || t == NSEC3PARAM || t == NSEC3;

if (IsDnssecType(type))
    throw new ArgumentException($"{type} is managed by the DNSSEC engine; use signing APIs.");

zone.SetRecords(type, records);
// static bool IsDnssecType(DnsResourceRecordType t) =>
//     t == DnsResourceRecordType.DNSKEY || t == DnsResourceRecordType.RRSIG ||
//     t == DnsResourceRecordType.NSEC || t == DnsResourceRecordType.NSEC3PARAM ||
//     t == DnsResourceRecordType.NSEC3;

static bool IsUserSettable(DnsResourceRecordType t) =>
    t != DnsResourceRecordType.DNSKEY && t != DnsResourceRecordType.RRSIG &&
    t != DnsResourceRecordType.NSEC && t != DnsResourceRecordType.NSEC3PARAM &&
    t != DnsResourceRecordType.NSEC3;

try { zone.SetRecords(type, records); }
catch (InvalidOperationException ex) when (ex.Message == "Cannot set DNSSEC records.")
{ Log.Error($"{type} is DNSSEC-managed; remove from input."); }

When it happens

Trigger: Calling SetRecords with DnsResourceRecordType.DNSKEY, RRSIG, NSEC, NSEC3PARAM, or NSEC3 on a primary zone.

Common situations: Bulk record-import tooling that does not exclude DNSSEC types; attempting to hand-edit signatures or NSEC chains; copy-pasting a signed zone's DNSSEC records into SetRecords on another zone.

Related errors

• Cannot add DNSSEC record.
• Cannot set DS record at zone apex.
• Cannot update DNSKEY TTL value: one or more private keys hav
• The record type is not supported by DNSSEC signed primary zo
• Cannot set records: disabling records in a signed zones is n

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/18dc4620bdc7960e. Report an issue: GitHub.