TechnitiumSoftware/DnsServer · error · DnsServerException

DNS Server does not have TSIG key '{tsigAuthenticatedKeyName

Error message

DNS Server does not have TSIG key '{tsigAuthenticatedKeyName}' configured to authenticate dynamic updates for {zoneInfo.TypeName} zone: {zoneInfo.DisplayName}

What it means

Thrown during zone secondary/zone transfer handling when tsigAuthenticatedKeyName is non-empty but no matching key exists in _tsigKeys (or _tsigKeys itself is null). TSIG (RFC 2845) signs dynamic updates and zone transfers; the server cannot authenticate to the primary without the configured key.

Source

Thrown at DnsServerCore/Dns/DnsServer.cs:3550

                                    List<NameServerAddress> updatedNameServers = new List<NameServerAddress>(primaryNameServerAddresses.Count);

                                    foreach (NameServerAddress primaryNameServer in primaryNameServerAddresses)
                                    {
                                        if (primaryNameServer.Protocol == DnsTransportProtocol.Tcp)
                                            updatedNameServers.Add(primaryNameServer);
                                        else
                                            updatedNameServers.Add(primaryNameServer.Clone(DnsTransportProtocol.Tcp));
                                    }

                                    primaryNameServerAddresses = updatedNameServers;
                                }
                                break;
                        }

                        TsigKey key = null;

                        if (!string.IsNullOrEmpty(tsigAuthenticatedKeyName) && ((_tsigKeys is null) || !_tsigKeys.TryGetValue(tsigAuthenticatedKeyName, out key)))
                            throw new DnsServerException("DNS Server does not have TSIG key '" + tsigAuthenticatedKeyName + "' configured to authenticate dynamic updates for " + zoneInfo.TypeName + " zone: " + zoneInfo.DisplayName);

                        DnsClient dnsClient = new DnsClient(primaryNameServerAddresses);

                        dnsClient.Proxy = _proxy;
                        dnsClient.IPv6Mode = _ipv6Mode;
                        dnsClient.Retries = _forwarderRetries;
                        dnsClient.Timeout = _forwarderTimeout;
                        dnsClient.Concurrency = 1;

                        DnsDatagram newRequest = request.Clone();
                        newRequest.SetRandomIdentifier();

                        DnsDatagram newResponse;

                        if (key is null)
                            newResponse = await dnsClient.RawResolveAsync(newRequest);
                        else
                            newResponse = await dnsClient.TsigResolveAsync(newRequest, key);

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Create a TSIG key with the exact name in Settings > TSIG Keys (or via the API) and update both peers to use it.
2. Match the key name case-sensitively between primary and secondary servers.
3. If TSIG is not actually needed, clear tsigAuthenticatedKeyName on the zone.
4. Re-sync the TSIG key (algorithm + secret) between both servers; both ends must share the identical key material.

Example fix

// before
zone.TsigKeyName = "transfer-key";   // no such key configured

// after
server.TsigKeys.Add(new TsigKey("transfer-key", TsigAlgorithm.HmacSha256, secret));
zone.TsigKeyName = "transfer-key";

void EnsureTsigKey(ITsigKeyStore keys, string? name)
{
    if (!string.IsNullOrEmpty(name) && (keys is null || !keys.Contains(name)))
        throw new ConfigurationException($"TSIG key '{name}' is not configured");
}

static bool TsigKeyExists(ITsigKeyStore keys, string? name)
    => string.IsNullOrEmpty(name) || (keys is not null && keys.Contains(name));

try { await server.DoZoneTransferAsync(zone); }
catch (DnsServerException ex) when (ex.Message.Contains("does not have TSIG key")) { log.Error("Create/rename the TSIG key referenced by the zone"); }

When it happens

Trigger: Configuring a secondary zone with TSIG-authenticated updates/transfers and referencing a key name not present in the TSIG key store; deleting a TSIG key without updating zones that reference it; case mismatch of the key name.

Common situations: Key name typo in zone config; key was renamed/deleted from Settings > TSIG Keys; copying zone config between servers without copying the TSIG keys; case sensitivity difference (BIND vs Technitium key-name casing).

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Current SOA serial does not match with the IXFR difference s
• Zone transfer TSIG key names cannot have more than 255 entri
• Already logged in. Please create a new object to use a diffe
• No active session exists. Please login and try again.
• DNS Server auth config file format is invalid.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/4d3fae0a7c8f2749. Report an issue: GitHub.