TechnitiumSoftware/DnsServer · error · InvalidDataException

DNSSEC private key format is invalid.

Error message

DNSSEC private key format is invalid.

What it means

Thrown by DnssecPrivateKey.ReadFrom when the first two bytes of the binary stream are not the ASCII magic "DK". This is the format signature of the library's proprietary DNSSEC private-key serialization; a missing/wrong magic means the data is corrupt, truncated, or not a DNSSEC key blob at all.

Source

Thrown at DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs:286

                case DnssecAlgorithm.ED448:
                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))
                    {
                        if (pemReader.ReadObject() is not Ed448PrivateKeyParameters privateKey)
                            throw new ArgumentException($"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must be for Ed448 curve.", nameof(pemPrivateKey));

                        return new DnssecEddsaPrivateKey(keyType, privateKey);
                    }

                default:
                    throw new NotSupportedException("DNSSEC algorithm is not supported: " + algorithm.ToString());
            }
        }

        public static DnssecPrivateKey ReadFrom(BinaryReader bR)
        {
            if (Encoding.ASCII.GetString(bR.BaseStream.ReadExactly(2)) != "DK")
                throw new InvalidDataException("DNSSEC private key format is invalid.");

            int version = bR.ReadByte();
            switch (version)
            {
                case 1:
                case 2:
                    DnssecAlgorithm algorithm = (DnssecAlgorithm)bR.ReadByte();
                    switch (algorithm)
                    {
                        case DnssecAlgorithm.RSAMD5:
                        case DnssecAlgorithm.RSASHA1:
                        case DnssecAlgorithm.RSASHA1_NSEC3_SHA1:
                        case DnssecAlgorithm.RSASHA256:
                        case DnssecAlgorithm.RSASHA512:
                            return new DnssecRsaPrivateKey(algorithm, bR, version);

                        case DnssecAlgorithm.ECDSAP256SHA256:
                        case DnssecAlgorithm.ECDSAP384SHA384:

View on GitHub (pinned to d0484b6c1e)

Solutions

  1. Ensure you are loading a file previously written by this library's DNSSEC key export (starts with "DK").
  2. Verify the file length and that the stream is at position 0 before reading.
  3. If you have a PEM instead, use the Create(algorithm, keyType, pem) overload rather than ReadFrom.

Example fix

// before
using var fs = File.OpenRead("zone.txt");
var key = DnssecPrivateKey.ReadFrom(new BinaryReader(fs)); // wrong file

// after
using var fs = File.OpenRead("ksk.dnssec.key"); // file written by this library
var key = DnssecPrivateKey.ReadFrom(new BinaryReader(fs));
Defensive patterns

Strategy: validation

Validate before calling

using var fs = File.OpenRead(path);
using var br = new BinaryReader(fs);
Span<byte> magic = stackalloc byte[2]; br.BaseStream.ReadExactly(magic);
if (Encoding.ASCII.GetString(magic) != "DK")
    throw new InvalidDataException($"{path} is not a DNSSEC private key file (bad magic).");
br.BaseStream.Seek(0, SeekOrigin.Begin);
var key = DnssecPrivateKey.ReadFrom(br);

Type guard

static bool LooksLikeDnssecKeyFile(string path)
{
    try
    {
        using var fs = File.OpenRead(path);
        Span<byte> b = stackalloc byte[2]; fs.ReadExactly(b);
        return b[0] == (byte)'D' && b[1] == (byte)'K';
    }
    catch { return false; }
}

Try / catch

try { return DnssecPrivateKey.ReadFrom(reader); }
catch (InvalidDataException ex) { throw new ConfigurationErrorsException("Selected file is not a valid DNSSEC key blob.", ex); }

Prevention

When it happens

Trigger: Calling DnssecPrivateKey.ReadFrom(binaryReader) on a stream whose first 2 bytes are not "DK" — e.g. a different file format, a corrupted key file, or a stream positioned past the start.

Common situations: Loading a non-key file (zone file, cert, PEM text) as a binary key; truncated download; reading from the wrong stream offset; version mismatch where the file was written by incompatible tooling.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/95be839242917346. Report an issue: GitHub.