TechnitiumSoftware/DnsServer · error · InvalidDataException

DNSSEC private key version not supported: {version}

Error message

DNSSEC private key version not supported: {version}

What it means

Thrown by the outer default branch of DnssecPrivateKey.ReadFrom when the version byte read after the magic is not 1 or 2. The format carries a version byte for forward compatibility; an unknown version means the file was written by a newer/incompatible version of the library and cannot be safely parsed by this one.

Source

Thrown at DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs:316

                        case DnssecAlgorithm.RSASHA1_NSEC3_SHA1:
                        case DnssecAlgorithm.RSASHA256:
                        case DnssecAlgorithm.RSASHA512:
                            return new DnssecRsaPrivateKey(algorithm, bR, version);

                        case DnssecAlgorithm.ECDSAP256SHA256:
                        case DnssecAlgorithm.ECDSAP384SHA384:
                            return new DnssecEcdsaPrivateKey(algorithm, bR, version);

                        case DnssecAlgorithm.ED25519:
                        case DnssecAlgorithm.ED448:
                            return new DnssecEddsaPrivateKey(algorithm, bR, version);

                        default:
                            throw new NotSupportedException("DNSSEC algorithm is not supported: " + algorithm.ToString());
                    }

                default:
                    throw new InvalidDataException("DNSSEC private key version not supported: " + version);
            }
        }

        #endregion

        #region protected

        protected void InitDnsKey(DnssecPublicKey publicKey)
        {
            DnsDnsKeyFlag flags = DnsDnsKeyFlag.ZoneKey;

            if (KeyType == DnssecPrivateKeyType.KeySigningKey)
                flags |= DnsDnsKeyFlag.SecureEntryPoint;

            if (_state == DnssecPrivateKeyState.Revoked)
                flags |= DnsDnsKeyFlag.Revoke;

            _dnsKey = new DnsDNSKEYRecordData(flags, 3, _algorithm, publicKey);

View on GitHub (pinned to d0484b6c1e)

Solutions

  1. Upgrade this library to a version that understands the key file's version, or re-export the key on the current version.
  2. Regenerate the DNSSEC key with the installed version and re-sign the zone.
  3. Confirm the key file was produced by a compatible version of this library.

Example fix

// before: key written by newer library (version 3)
var key = DnssecPrivateKey.ReadFrom(reader); // throws

// after: regenerate with current version
var key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP256SHA256, kt);
// then re-sign the zone and redistribute the new key
Defensive patterns

Strategy: validation

Validate before calling

using var fs = File.OpenRead(path);
using var br = new BinaryReader(fs);
br.BaseStream.ReadExactly(stackalloc byte[2]); // skip "DK"
int version = br.ReadByte();
if (version is not (1 or 2))
    throw new InvalidDataException($"Key file version {version} is not supported by this build; upgrade or regenerate.");
br.BaseStream.Seek(0, SeekOrigin.Begin);
var key = DnssecPrivateKey.ReadFrom(br);

Type guard

static bool IsSupportedKeyVersion(string path)
{
    try
    {
        using var fs = File.OpenRead(path);
        using var br = new BinaryReader(fs);
        br.BaseStream.ReadExactly(stackalloc byte[2]);
        return br.ReadByte() is 1 or 2;
    }
    catch { return false; }
}

Try / catch

try { return DnssecPrivateKey.ReadFrom(reader); }
catch (InvalidDataException ex) { throw new ConfigurationErrorsException("Key file version is unsupported; upgrade the library or regenerate the key.", ex); }

Prevention

When it happens

Trigger: ReadFrom on a key blob whose version byte (third byte) is anything other than 1 or 2.

Common situations: Downgrading: key file written by a newer library version that this older build doesn't recognize; corrupted version byte; file from an unrelated tool that happened to start with "DK".

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/390332b4b3434d18. Report an issue: GitHub.