TechnitiumSoftware/DnsServer · critical · InvalidDataException

DNS Server auth config file format is invalid.

Error message

DNS Server auth config file format is invalid.

What it means

Thrown as InvalidDataException while reading the auth config binary stream when the first two bytes are not the ASCII magic "AS". The auth.config file is a custom binary format, and this check guards the very first read before parsing users, groups, permissions, and sessions. It surfaces at server startup (LoadConfigFile), during admin reset (resetadmin.config), or during config transfer/backup restore, and it stops the server from booting on a corrupt or foreign file.

Source

Thrown at DnsServerCore/Auth/AuthManager.cs:387

                if (immediately)
                {
                    SaveConfigFileInternal();
                    _pendingSave = false;
                    return;
                }

                if (_pendingSave)
                    return;

                _pendingSave = true;
                _saveTimer.Change(SAVE_TIMER_INITIAL_INTERVAL, Timeout.Infinite);
            }
        }

        private void ReadConfigFrom(Stream s, bool isConfigTransfer, out bool restartWebService)
        {
            if (Encoding.ASCII.GetString(s.ReadExactly(2)) != "AS") //format
                throw new InvalidDataException("DNS Server auth config file format is invalid.");

            restartWebService = false;

            ConcurrentDictionary<string, Group> groups = new ConcurrentDictionary<string, Group>(1, 4);
            ConcurrentDictionary<string, User> users = new ConcurrentDictionary<string, User>(1, 4);
            ConcurrentDictionary<PermissionSection, Permission> permissions = new ConcurrentDictionary<PermissionSection, Permission>(1, 11);
            ConcurrentDictionary<string, UserSession> sessions = new ConcurrentDictionary<string, UserSession>(1, 10);

            BinaryReader bR = new BinaryReader(s);

            int version = bR.ReadByte();
            switch (version)
            {
                case 1:
                case 2:
                case 3:
                    {
                        int count = bR.ReadByte();

View on GitHub (pinned to d0484b6c1e)

Solutions

  1. Restore auth.config from a known-good backup or delete it so the server regenerates a fresh default config with the admin/admin account.
  2. If using resetadmin.config, regenerate it via the official password-reset procedure instead of hand-crafting a file.
  3. Verify the file is at least 2 bytes and starts with bytes 41 53 hex ('AS') before starting the server.
  4. For backup restore, ensure the archive was produced by the same DNS Server version and that the auth.config entry is intact.

Example fix

// before: corrupt/empty auth.config prevents startup
// after: validate the header before attempting a load, or let the server recreate it
using var fs = File.OpenRead(authConfigPath);
Span<byte> hdr = stackalloc byte[2];
if (await fs.ReadAsync(hdr) < 2 || hdr[0] != (byte)'A' || hdr[1] != (byte)'S')
{
    File.Delete(authConfigPath); // force regeneration of default config
}
Defensive patterns

Strategy: try-catch

Validate before calling

// Validate the auth.config header before letting the server load it
byte[] head = File.ReadAllBytes(authConfigPath).AsSpan(0, 2).ToArray();
if (head.Length < 2 || head[0] != (byte)'A' || head[1] != (byte)'S')
    throw new InvalidOperationException("auth.config is not a valid DNS Server auth config; header check failed.");

Type guard

bool IsValidAuthConfigHeader(byte[] bytes) => bytes.Length >= 2 && bytes[0] == (byte)'A' && bytes[1] == (byte)'S';

Try / catch

try { StartServer(); }
catch (InvalidDataException ex) when (ex.Message.Contains("auth config file format is invalid"))
{
    // restore from backup or delete auth.config to regenerate defaults
    RestoreAuthConfigBackupOrReset();
}

Prevention

When it happens

Trigger: Calling ReadConfigFrom on a stream whose first two bytes are not 0x41 0x53 ('AS'): an empty/truncated auth.config, a zero-byte file, a text file dropped into the config folder, or a restore that pulled in a non-auth file as auth.config.

Common situations: Config folder got corrupted by a crash mid-write or disk-full event; a backup restore pointed at the wrong archive entry; a manual edit of auth.config with a text editor destroyed the binary header; docker volume mount overwrote auth.config with a directory or empty bind-mount.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/92bb095975522636. Report an issue: GitHub.