TechnitiumSoftware/DnsServer · error · DnsServerException

Cannot set records: disabling records in a signed zones is n

Error message

Cannot set records: disabling records in a signed zones is not supported.

What it means

Thrown by PrimarySubDomainZone.SetRecords() inside the DNSSEC guard when any record in the set has GetAuthGenericRecordInfo().Disabled == true and the parent zone is signed. A 'disabled' record is served with the existing RRset but excluded from answers, and DNSSEC signing expects every stored record in an RRset to be part of the signed set — disabling records mid-RRset would desync signatures and let validators detect tampering. The message contains a typo ('a signed zones') but the condition is exact. DnsServerException, catchable.

Source

Thrown at DnsServerCore/Dns/Zones/PrimarySubDomainZone.cs:70

        #endregion

        #region public

        public override void SetRecords(DnsResourceRecordType type, IReadOnlyList<DnsResourceRecord> records)
        {
            if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)
            {
                switch (type)
                {
                    case DnsResourceRecordType.ANAME:
                    case DnsResourceRecordType.APP:
                        throw new DnsServerException("The record type is not supported by DNSSEC signed primary zones.");

                    default:
                        foreach (DnsResourceRecord record in records)
                        {
                            if (record.GetAuthGenericRecordInfo().Disabled)
                                throw new DnsServerException("Cannot set records: disabling records in a signed zones is not supported.");
                        }

                        break;
                }
            }

            switch (type)
            {
                case DnsResourceRecordType.SOA:
                    throw new InvalidOperationException("Cannot set SOA record on sub domain.");

                case DnsResourceRecordType.DNSKEY:
                case DnsResourceRecordType.RRSIG:
                case DnsResourceRecordType.NSEC:
                case DnsResourceRecordType.NSEC3PARAM:
                case DnsResourceRecordType.NSEC3:
                    throw new InvalidOperationException("Cannot set DNSSEC records.");

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Do not set Disabled=true on records in a DNSSEC-signed zone; enable/disable by toggling the whole RRset or by removing the record instead.
2. Clear record.GetAuthGenericRecordInfo().Disabled = false before calling SetRecords when the zone is signed.
3. If staged rollout is needed, disable DNSSEC or add/remove records rather than marking them disabled.

Example fix

// before
rec.GetAuthGenericRecordInfo().Disabled = true;
zone.SetRecords(type, new[] { rec });

// after (signed zone)
rec.GetAuthGenericRecordInfo().Disabled = false;
zone.SetRecords(type, new[] { rec });
// to hide it, omit it from the set instead of disabling it

if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)
    foreach (var r in records)
        r.GetAuthGenericRecordInfo().Disabled = false;
zone.SetRecords(type, records);

static bool NoDisabledRecords(IReadOnlyList<DnsResourceRecord> records) => records.All(r => !r.GetAuthGenericRecordInfo().Disabled);

try { zone.SetRecords(type, records); }
catch (DnsServerException ex) when (ex.Message.Contains("disabling records")) { /* clear Disabled and retry */ }

When it happens

Trigger: zone.SetRecords(type, records) on a signed PrimarySubDomainZone where one or more records were created/marked Disabled=true (e.g. via the UI 'disable record' toggle) before the set call.

Common situations: Bulk import of records that preserves a 'disabled/parked' flag; scripted provisioning that pre-disables records for staged rollout; re-enabling records but forgetting to clear Disabled on a signed zone.

Related errors

• Cannot add record: disabling records in a signed zones is no
• The record type is not supported by DNSSEC signed primary zo
• Cannot set DNSSEC records.
• The record type is not supported by primary zones.
• Cannot set records: TTL cannot be greater than SOA EXPIRE.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/8bd60fcf40fc0d98. Report an issue: GitHub.