TechnitiumSoftware/DnsServer · error · InvalidOperationException

Current SOA serial does not match with the IXFR difference s

Error message

Current SOA serial does not match with the IXFR difference sequence deleted SOA.

What it means

Thrown while APPLYING an incoming Incremental Zone Transfer (IXFR) to a secondary zone. After walking each difference sequence (deleted/added records bracketed by SOA records), the server asserts that the sequence's 'deleted SOA' serial equals the local zone's current SOA serial. This guarantees the incremental delta applies against the exact base version the secondary currently holds. A mismatch means the delta is not a valid successor of the local state, so applying it would corrupt the zone.

Source

Thrown at DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs:2823

                        {
                            switch (record.Type)
                            {
                                case DnsResourceRecordType.A:
                                case DnsResourceRecordType.AAAA:
                                    addedGlueRecords.Add(record);
                                    break;
                            }
                        }
                    }

                    index++;
                }

                //check sequence soa serial
                DnsSOARecordData deletedSoa = deletedSoaRecord.RDATA as DnsSOARecordData;

                if (currentSoa.Serial != deletedSoa.Serial)
                    throw new InvalidOperationException("Current SOA serial does not match with the IXFR difference sequence deleted SOA.");

                //sync difference sequence
                if (deletedRecords.Count > 0)
                {
                    foreach (KeyValuePair<string, Dictionary<DnsResourceRecordType, List<DnsResourceRecord>>> deletedEntry in DnsResourceRecord.GroupRecords(deletedRecords))
                    {
                        AuthZone zone = GetOrAddSubDomainZone(zoneName, deletedEntry.Key);

                        if (zone.Name.Equals(zoneName, StringComparison.OrdinalIgnoreCase))
                        {
                            zone.SyncRecords(deletedEntry.Value, null);
                        }
                        else if ((zone is SubDomainZone subDomainZone) && subDomainZone.AuthoritativeZone.Name.Equals(zoneName, StringComparison.OrdinalIgnoreCase))
                        {
                            zone.SyncRecords(deletedEntry.Value, null);

                            if (zone.IsEmpty)
                                _root.TryRemove(deletedEntry.Key, out SubDomainZone _); //remove empty sub zone

View on GitHub (pinned to d0484b6c1e)

Solutions

Force a full zone transfer (AXFR) for the affected secondary zone so it resynchronizes to the primary's current serial.
Verify the primary's SOA serial is monotonically increasing and obeys RFC 1982 serial arithmetic.
Delete and re-add the secondary zone (or clear its zone file) so the next transfer is a clean AXFR rather than IXFR.
Inspect primary + secondary logs for serial jumps or dropped NOTIFY messages that left the delta chain broken.

Example fix

// before: secondary zone repeatedly fails IXFR with serial mismatch
//   (server log: 'Current SOA serial does not match...')
// after: force full reload so IXFR delta chain restarts from a known base
//   GUI: Zones > <zone> > Manage > 'Transfer Zone Now'
//   or remove the secondary zone and re-add it to trigger an AXFR

Defensive patterns

Strategy: retry

Validate before calling

// Before accepting an IXFR, ensure local SOA serial is a valid predecessor
var currentSerial = secondaryZone.SOARecord.RDATA.Serial;
// compare against the primary's current SOA before requesting IXFR
if (!IsSerialPredecessor(currentSerial, primarySerial))
    RequestAxfrInstead(secondaryZone); // full transfer avoids the mismatch

Try / catch

try
{
    secondaryZone.DoZoneTransfer(ZoneTransferType.Ixfr);
}
catch (InvalidOperationException ex) when (ex.Message.Contains("IXFR difference sequence"))
{
    // delta chain is out of sync -> fall back to a full AXFR
    secondaryZone.DoZoneTransfer(ZoneTransferType.Axfr);
}

Prevention

Never hand-edit the primary's SOA serial; let the server advance it monotonically.
After any serial reset on the primary, force all secondaries to AXFR once.
Monitor secondary transfer logs for serial-mismatch messages and auto-trigger AXFR.
Keep the primary->secondary chain short to reduce serial skew.

When it happens

Trigger: Secondary zone pulls IXFR from a primary whose SOA serial advanced past the delta's expected base serial; partial/truncated IXFR response where the closing deleted-SOA does not line up with local serial; serial number rollback or wrap on the primary mid-transfer; concurrent NOTIFY-triggered transfers racing a serial change.

Common situations: Primary's SOA serial was edited or reset manually; a long secondary chain (primary -> secondary -> secondary) accumulated serial skew; an interrupted IXFR resumed from stale state; primary switched serial numbering scheme (e.g. date-based to counter) without a full AXFR first.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/a5808506c9585168. Report an issue: GitHub.