TechnitiumSoftware/DnsServer · error · DnsServerException

Cannot update record: disabling records in a signed zones is

Error message

Cannot update record: disabling records in a signed zones is not supported.

What it means

Thrown by PrimaryZone.UpdateRecord (default case) when the zone is DNSSEC-signed (_dnssecStatus != Unsigned) and the new record is being disabled (newRecord.GetAuthGenericRecordInfo().Disabled == true). Disabling a record in a signed zone would invalidate the chain of trust (RRSIG/NSEC), so the library rejects it as a DnsServerException.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:2759

        {
            switch (oldRecord.Type)
            {
                case DnsResourceRecordType.SOA:
                    throw new InvalidOperationException("Cannot update record: use SetRecords() for " + oldRecord.Type.ToString() + " record");

                case DnsResourceRecordType.DNSKEY:
                case DnsResourceRecordType.RRSIG:
                case DnsResourceRecordType.NSEC:
                case DnsResourceRecordType.NSEC3PARAM:
                case DnsResourceRecordType.NSEC3:
                    throw new InvalidOperationException("Cannot update DNSSEC records.");

                default:
                    if (oldRecord.Type != newRecord.Type)
                        throw new InvalidOperationException("Old and new record types do not match.");

                    if ((_dnssecStatus != AuthZoneDnssecStatus.Unsigned) && newRecord.GetAuthGenericRecordInfo().Disabled)
                        throw new DnsServerException("Cannot update record: disabling records in a signed zones is not supported.");

                    if (newRecord.OriginalTtlValue > GetZoneSoaExpire())
                        throw new DnsServerException("Cannot update record: TTL cannot be greater than SOA EXPIRE.");

                    if (!TryDeleteRecord(oldRecord.Type, oldRecord.RDATA, out DnsResourceRecord deletedRecord))
                        throw new DnsServerException("Cannot update record: the record does not exists to be updated.");

                    AddRecord(newRecord, out IReadOnlyList<DnsResourceRecord> addedRecords, out IReadOnlyList<DnsResourceRecord> deletedRecords);

                    List<DnsResourceRecord> allDeletedRecords = new List<DnsResourceRecord>(deletedRecords.Count + 1);
                    allDeletedRecords.Add(deletedRecord);
                    allDeletedRecords.AddRange(deletedRecords);

                    CommitAndIncrementSerial(allDeletedRecords, addedRecords);

                    if (_dnssecStatus != AuthZoneDnssecStatus.Unsigned)
                        UpdateDnssecRecordsFor(this, oldRecord.Type);

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Remove the DISABLED flag on newRecord before updating in a signed zone.
2. If disabling is genuinely needed, unsign the zone first, then re-sign after.
3. Delete the record instead of disabling it (the signing engine regenerates NSEC).

Example fix

// before
var info = newRecord.GetAuthGenericRecordInfo();
info.Disabled = true;
zone.UpdateRecord(oldRecord, newRecord);

// after
var info = newRecord.GetAuthGenericRecordInfo();
info.Disabled = false; // signed zone: do not disable
zone.UpdateRecord(oldRecord, newRecord);

if (zone.GetDnssecStatus() != AuthZoneDnssecStatus.Unsigned &&
    newRecord.GetAuthGenericRecordInfo().Disabled)
    newRecord.GetAuthGenericRecordInfo().Disabled = false;
zone.UpdateRecord(oldRecord, newRecord);

static bool CanDisableInZone(AuthZoneDnssecStatus status, DnsResourceRecord r) =>
    status == AuthZoneDnssecStatus.Unsigned || !r.GetAuthGenericRecordInfo().Disabled;

null

When it happens

Trigger: Calling zone.UpdateRecord on a signed PrimaryZone with a newRecord whose Disabled flag is set; toggling the disabled bit on a record in a zone with active DNSSEC.

Common situations: Temporarily disabling a record for maintenance; importing records that carry the DISABLED pseudo-RR flag; pausing a service behind a record in a signed zone.

Related errors

• Cannot set records: disabling records in a signed zones is n
• Cannot add record: disabling records in a signed zones is no
• Valid RSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ?
• No such primary zone was found: <zoneName>
• No such primary zone was found: {zoneName}

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/0230a37b29e871e3. Report an issue: GitHub.