TechnitiumSoftware/DnsServer · error · DnsServerException

Cannot update record: disabling records in a signed zones is

Error message

Cannot update record: disabling records in a signed zones is not supported.

What it means

Thrown by PrimarySubDomainZone.UpdateRecord when the zone is DNSSEC-signed (_primaryZone.DnssecStatus != Unsigned) AND the new record has its AuthGenericRecordInfo.Disabled flag set. Disabling (RFC 4041) a record changes the RRset that must be signed; this implementation does not support disabling records in a signed zone, so it raises DnsServerException before applying the update. (Message text 'zones' is a verbatim source typo.)

Source

Thrown at DnsServerCore/Dns/Zones/PrimarySubDomainZone.cs:236

        {
            switch (oldRecord.Type)
            {
                case DnsResourceRecordType.SOA:
                    throw new InvalidOperationException("Cannot update record: use SetRecords() for " + oldRecord.Type.ToString() + " record.");

                case DnsResourceRecordType.DNSKEY:
                case DnsResourceRecordType.RRSIG:
                case DnsResourceRecordType.NSEC:
                case DnsResourceRecordType.NSEC3PARAM:
                case DnsResourceRecordType.NSEC3:
                    throw new InvalidOperationException("Cannot update DNSSEC records.");

                default:
                    if (oldRecord.Type != newRecord.Type)
                        throw new InvalidOperationException("Old and new record types do not match.");

                    if ((_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned) && newRecord.GetAuthGenericRecordInfo().Disabled)
                        throw new DnsServerException("Cannot update record: disabling records in a signed zones is not supported.");

                    if (newRecord.OriginalTtlValue > _primaryZone.GetZoneSoaExpire())
                        throw new DnsServerException("Cannot update record: TTL cannot be greater than SOA EXPIRE.");

                    if (!TryDeleteRecord(oldRecord.Type, oldRecord.RDATA, out DnsResourceRecord deletedRecord))
                        throw new InvalidOperationException("Cannot update record: the record does not exists to be updated.");

                    AddRecord(newRecord, out IReadOnlyList<DnsResourceRecord> addedRecords, out IReadOnlyList<DnsResourceRecord> deletedRecords);

                    List<DnsResourceRecord> allDeletedRecords = new List<DnsResourceRecord>(deletedRecords.Count + 1);
                    allDeletedRecords.Add(deletedRecord);
                    allDeletedRecords.AddRange(deletedRecords);

                    _primaryZone.CommitAndIncrementSerial(allDeletedRecords, addedRecords);

                    if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)
                        _primaryZone.UpdateDnssecRecordsFor(this, oldRecord.Type);

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Do not set Disabled=true on records in a signed zone; delete the record instead.
2. Unsign the zone first if disabling is mandatory, then re-sign.
3. Clear the Disabled flag on newRecord before updating.

Example fix

// before
newRecord.GetAuthGenericRecordInfo().Disabled = true;
zone.UpdateRecord(old, newRecord); // signed zone

// after
newRecord.GetAuthGenericRecordInfo().Disabled = false;
zone.UpdateRecord(old, newRecord);

bool signed = primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned;
if (signed && newRecord.GetAuthGenericRecordInfo().Disabled)
    newRecord.GetAuthGenericRecordInfo().Disabled = false; // or unsign first
zone.UpdateRecord(oldRecord, newRecord);

static bool IsDisabledAllowed(AuthZoneDnssecStatus status, DnsResourceRecord r) =>
    status == AuthZoneDnssecStatus.Unsigned || !r.GetAuthGenericRecordInfo().Disabled;

When it happens

Trigger: zone.UpdateRecord(old, new) where newRecord.GetAuthGenericRecordInfo().Disabled is true and the zone is signed (SignedWithNSEC or SignedWithNSEC3).

Common situations: Temporarily disabling a record for maintenance while DNSSEC is enabled; importing records that carry a 'disabled' flag into a signed zone.

Related errors

• Cannot delete DNSSEC records.
• Cannot update DNSSEC records.
• Cannot update record: use SetRecords() for {oldRecord.Type}
• Old and new record types do not match.
• Cannot update record: the record does not exists to be updat

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/fba6ff44c8b3cc18. Report an issue: GitHub.