TechnitiumSoftware/DnsServer · error · DnsServerException

Cannot set records: disabling records in a signed zones is n

Error message

Cannot set records: disabling records in a signed zones is not supported.

What it means

Thrown by PrimaryZone.SetRecords() on a signed zone when any record in the input list has its Disabled flag set (record.GetAuthGenericRecordInfo().Disabled == true). Signed zones must sign every record in an RRset, and a disabled record would break the RRset/NSEC chain consistency, so disabling records is disallowed in signed zones.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:2522

        {
            return "Primary";
        }

        public override void SetRecords(DnsResourceRecordType type, IReadOnlyList<DnsResourceRecord> records)
        {
            if (_dnssecStatus != AuthZoneDnssecStatus.Unsigned)
            {
                switch (type)
                {
                    case DnsResourceRecordType.ANAME:
                    case DnsResourceRecordType.APP:
                        throw new DnsServerException("The record type is not supported by DNSSEC signed primary zones.");

                    default:
                        foreach (DnsResourceRecord record in records)
                        {
                            if (record.GetAuthGenericRecordInfo().Disabled)
                                throw new DnsServerException("Cannot set records: disabling records in a signed zones is not supported.");
                        }

                        break;
                }
            }

            switch (type)
            {
                case DnsResourceRecordType.CNAME:
                case DnsResourceRecordType.DS:
                    throw new InvalidOperationException("Cannot set " + type.ToString() + " record at zone apex.");

                case DnsResourceRecordType.SOA:
                    if ((records.Count != 1) || !records[0].Name.Equals(_name, StringComparison.OrdinalIgnoreCase))
                        throw new InvalidOperationException("Invalid SOA record.");

                    DnsResourceRecord newSoaRecord = records[0];
                    DnsSOARecordData newSoa = newSoaRecord.RDATA as DnsSOARecordData;

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Clear the Disabled flag on every record before passing them to SetRecords on a signed zone, or remove the record instead of disabling it.
2. If you need to temporarily withdraw a record from a signed zone, delete it (the zone will re-sign) rather than disabling it.
3. Filter or normalize the record list to ensure no Disabled entries reach SetRecords for signed zones.

Example fix

// before
zone.SetRecords(type, records); // throws if any record.Disabled

// after
var enabled = records.Where(r => !r.GetAuthGenericRecordInfo().Disabled).ToList();
zone.SetRecords(type, enabled);

// Drop or enable disabled records before SetRecords on a signed zone.
if (IsZoneSigned(zone))
    records = records.Where(r => !r.GetAuthGenericRecordInfo().Disabled).ToList();

zone.SetRecords(type, records);

static bool HasNoDisabledRecords(IReadOnlyList<DnsResourceRecord> rs) =>
    rs.All(r => !r.GetAuthGenericRecordInfo().Disabled);

try { zone.SetRecords(type, records); }
catch (DnsServerException ex) when (ex.Message.Contains("disabling records in a signed zones"))
{ Log.Error("Remove Disabled records before writing to a signed zone."); }

When it happens

Trigger: Calling SetRecords on a signed primary zone with one or more records whose AuthGenericRecordInfo.Disabled is true.

Common situations: Importing a zone export that contains paused/disabled records into a signed zone; a UI that lets operators disable individual records re-saving the zone after signing.

Related errors

• Cannot add record: disabling records in a signed zones is no
• The record type is not supported by DNSSEC signed primary zo
• Cannot delete DNSSEC records.
• Cannot update DNSSEC records.
• Cannot update record: disabling records in a signed zones is

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/3c4ab06a24bc5087. Report an issue: GitHub.