TechnitiumSoftware/DnsServer · error · NotSupportedException

DNSSEC algorithm is not supported: {algorithm}

Error message

DNSSEC algorithm is not supported: {algorithm}

What it means

Thrown by the default branch of DnssecPrivateKey.Create (keySize overload) when the supplied DnssecAlgorithm is not one of the supported set: RSAMD5, RSASHA1, RSASHA1-NSEC3-SHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, ED448. Algorithms like DSA, DSA-NSEC3-SHA1, ECC-GOST, or any undefined enum value reach this branch. This is a NotSupportedException because the algorithm is known to DNSSEC but not implemented.

Source

Thrown at DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs:215

                    using (ECDsa ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP256))
                    {
                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));
                    }

                case DnssecAlgorithm.ECDSAP384SHA384:
                    using (ECDsa ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP384))
                    {
                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));
                    }

                case DnssecAlgorithm.ED25519:
                    return new DnssecEddsaPrivateKey(keyType, new Ed25519PrivateKeyParameters(RandomNumberGenerator.GetBytes(32)));

                case DnssecAlgorithm.ED448:
                    return new DnssecEddsaPrivateKey(keyType, new Ed448PrivateKeyParameters(RandomNumberGenerator.GetBytes(57)));

                default:
                    throw new NotSupportedException("DNSSEC algorithm is not supported: " + algorithm.ToString());
            }
        }

        public static DnssecPrivateKey Create(DnssecAlgorithm algorithm, DnssecPrivateKeyType keyType, string pemPrivateKey)
        {
            switch (algorithm)
            {
                case DnssecAlgorithm.RSAMD5:
                case DnssecAlgorithm.RSASHA1:
                case DnssecAlgorithm.RSASHA1_NSEC3_SHA1:
                case DnssecAlgorithm.RSASHA256:
                case DnssecAlgorithm.RSASHA512:
                    using (RSA rsa = RSA.Create())
                    {
                        rsa.ImportFromPem(pemPrivateKey);

                        if ((rsa.KeySize < 1024) || (rsa.KeySize > 4096))
                            throw new ArgumentOutOfRangeException(nameof(pemPrivateKey), $"Valid RSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key size range is between 1024-4096 bits.");

View on GitHub (pinned to d0484b6c1e)

Solutions

  1. Use one of the supported algorithms (RSASHA256/RSASHA512, ECDSAP256SHA256/ECDSAP384SHA384, or ED25519/ED448).
  2. Validate the algorithm against the supported set before calling Create.
  3. If you need DSA/GOST, switch to an algorithm this library implements.

Example fix

// before
var key = DnssecPrivateKey.Create(DnssecAlgorithm.DSA, DnssecPrivateKeyType.ZoneSigningKey, 1024);

// after
var key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP256SHA256, DnssecPrivateKeyType.ZoneSigningKey);
Defensive patterns

Strategy: type-guard

Validate before calling

static readonly HashSet<DnssecAlgorithm> Supported = new()
{
    DnssecAlgorithm.RSAMD5, DnssecAlgorithm.RSASHA1, DnssecAlgorithm.RSASHA1_NSEC3_SHA1,
    DnssecAlgorithm.RSASHA256, DnssecAlgorithm.RSASHA512,
    DnssecAlgorithm.ECDSAP256SHA256, DnssecAlgorithm.ECDSAP384SHA384,
    DnssecAlgorithm.ED25519, DnssecAlgorithm.ED448,
};

if (!Supported.Contains(algo))
    throw new ArgumentException($"Algorithm {algo} is not supported by this build.");
var key = DnssecPrivateKey.Create(algo, keyType, keySize);

Type guard

static bool IsSupportedDnssecAlgorithm(DnssecAlgorithm a) =>
    a is DnssecAlgorithm.RSAMD5 or DnssecAlgorithm.RSASHA1
       or DnssecAlgorithm.RSASHA1_NSEC3_SHA1 or DnssecAlgorithm.RSASHA256
       or DnssecAlgorithm.RSASHA512 or DnssecAlgorithm.ECDSAP256SHA256
       or DnssecAlgorithm.ECDSAP384SHA384 or DnssecAlgorithm.ED25519
       or DnssecAlgorithm.ED448;

Try / catch

try { return DnssecPrivateKey.Create(algo, keyType, keySize); }
catch (NotSupportedException) { /* unsupported algorithm */ throw new ArgumentException("Pick a supported DNSSEC algorithm."); }

Prevention

When it happens

Trigger: Calling DnssecPrivateKey.Create with DnssecAlgorithm.DSA, DnssecAlgorithm.DSA_NSEC3_SHA1, DnssecAlgorithm.ECC_GOST, or a cast integer that does not map to a supported algorithm.

Common situations: Parsing an algorithm name/value from user input or a DS record without filtering; importing keys intended for an algorithm this build doesn't implement; casting an out-of-range byte to the enum.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/f8242b9140bd49b9. Report an issue: GitHub.