TechnitiumSoftware/DnsServer · error · DhcpServerException

Cannot update reverse DNS zone '{reverseZoneInfo.DisplayName

Error message

Cannot update reverse DNS zone '{reverseZoneInfo.DisplayName}': not a primary or a forwarder zone.

What it means

Reverse-DNS counterpart of the forward-zone error. DhcpServer computes the reverse zone from the scope address/subnet (Zone.GetReverseZone) and refuses to update an existing reverse AuthZone whose type is not Primary or Forwarder. Only fires when reverseZoneInfo.Name equals the computed reverse zone name.

Source

Thrown at DnsServerCore/Dhcp/DhcpServer.cs:896

                    {
                        _log.Write("DHCP Server failed to create DNS primary zone '" + reverseZone + "'.");
                        return;
                    }

                    //set permissions
                    _authManager.SetPermission(PermissionSection.Zones, reverseZoneInfo.Name, _authManager.GetGroup(Group.ADMINISTRATORS), PermissionFlag.ViewModifyDelete);
                    _authManager.SetPermission(PermissionSection.Zones, reverseZoneInfo.Name, _authManager.GetGroup(Group.DNS_ADMINISTRATORS), PermissionFlag.ViewModifyDelete);
                    _authManager.SetPermission(PermissionSection.Zones, reverseZoneInfo.Name, _authManager.GetGroup(Group.DHCP_ADMINISTRATORS), PermissionFlag.ViewModifyDelete);
                    _authManager.SaveConfigFile();

                    _log.Write("DHCP Server create DNS primary zone '" + reverseZoneInfo.DisplayName + "'.");
                }
                else if ((reverseZoneInfo.Type != AuthZoneType.Primary) && (reverseZoneInfo.Type != AuthZoneType.Forwarder))
                {
                    string reverseZone = Zone.GetReverseZone(address, scope.SubnetMask);

                    if (reverseZoneInfo.Name.Equals(reverseZone, StringComparison.OrdinalIgnoreCase))
                        throw new DhcpServerException("Cannot update reverse DNS zone '" + reverseZoneInfo.DisplayName + "': not a primary or a forwarder zone.");

                    //create new reverse primary zone
                    reverseZoneInfo = _dnsServer.AuthZoneManager.CreatePrimaryZone(reverseZone);
                    if (reverseZoneInfo is null)
                    {
                        _log.Write("DHCP Server failed to create DNS primary zone '" + reverseZone + "'.");
                        return;
                    }

                    //set permissions
                    _authManager.SetPermission(PermissionSection.Zones, reverseZoneInfo.Name, _authManager.GetGroup(Group.ADMINISTRATORS), PermissionFlag.ViewModifyDelete);
                    _authManager.SetPermission(PermissionSection.Zones, reverseZoneInfo.Name, _authManager.GetGroup(Group.DNS_ADMINISTRATORS), PermissionFlag.ViewModifyDelete);
                    _authManager.SetPermission(PermissionSection.Zones, reverseZoneInfo.Name, _authManager.GetGroup(Group.DHCP_ADMINISTRATORS), PermissionFlag.ViewModifyDelete);
                    _authManager.SaveConfigFile();

                    _log.Write("DHCP Server create DNS primary zone '" + reverseZoneInfo.DisplayName + "'.");
                }

View on GitHub (pinned to d0484b6c1e)

Solutions

Convert the existing reverse zone (in-addr.arpa) to Primary or Forwarder, then re-enable the scope.
Delete the non-Primary reverse zone so DHCP can auto-create one.
Re-scope the address range so the computed reverse zone name does not collide.

Example fix

// before: reverse zone '1.168.192.in-addr.arpa' is Secondary
// after
_dnsServer.AuthZoneManager.SetZoneType('1.168.192.in-addr.arpa', AuthZoneType.Primary);
_dhcpServer.EnableScope('lan');

Defensive patterns

Strategy: validation

Validate before calling

string rz = Zone.GetReverseZone(scope.StartingAddress, scope.SubnetMask);
var zone = _dnsServer.AuthZoneManager.GetZone(rz);
if (zone != null && zone.Type != AuthZoneType.Primary && zone.Type != AuthZoneType.Forwarder)
    throw new InvalidOperationException($"Reverse zone '{rz}' is {zone.Type}; convert to Primary/Forwarder.");

Type guard

static bool ReverseZoneWritable(AuthZoneInfo z) => z == null || z.Type == AuthZoneType.Primary || z.Type == AuthZoneType.Forwarder;

Try / catch

try { _dhcpServer.EnableScope(scope.Name); }
catch (DhcpServerException ex) when (ex.Message.Contains("reverse DNS zone") && ex.Message.Contains("not a primary or a forwarder zone"))
{ /* fix reverse zone type, retry */ }

Prevention

Manage reverse zones for DHCP subnets as Primary.
Compute the expected reverse zone name and pre-check its type.
Avoid importing Secondary reverse zones over in-use subnets.

When it happens

Trigger: Enabling a scope where the reverse zone (e.g. '1.168.192.in-addr.arpa') already exists with Type other than Primary/Forwarder AND its name matches Zone.GetReverseZone(address, subnetMask).

Common situations: A Secondary reverse zone was imported/created for the same subnet. Reverse zone type changed to Stub/Cache. Migrating configs where reverse zones ended up non-writable.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/4d46019f6a783b69. Report an issue: GitHub.