TechnitiumSoftware/DnsServer · critical · DnsWebServiceException

Failed to read 'Zones' permissions: auth.config file is prob

Error message

Failed to read 'Zones' permissions: auth.config file is probably corrupt.

What it means

Thrown by DnsWebService.InspectAndFixZonePermissions when _authManager.GetPermission(PermissionSection.Zones) returns null, meaning the Zones permission block is absent from auth.config. This routine reconciles per-zone permissions against existing zones and runs during startup/save; a missing top-level Zones section is treated as corruption because the server cannot reason about zone access without it.

Source

Thrown at DnsServerCore/DnsWebService.cs:439

        }

        public void SaveConfigFile()
        {
            lock (_saveLock)
            {
                if (_pendingSave)
                    return;

                _pendingSave = true;
                _saveTimer.Change(SAVE_TIMER_INITIAL_INTERVAL, Timeout.Infinite);
            }
        }

        private void InspectAndFixZonePermissions()
        {
            Permission permission = _authManager.GetPermission(PermissionSection.Zones);
            if (permission is null)
                throw new DnsWebServiceException("Failed to read 'Zones' permissions: auth.config file is probably corrupt.");

            IReadOnlyDictionary<string, Permission> subItemPermissions = permission.SubItemPermissions;

            //remove ghost permissions
            foreach (KeyValuePair<string, Permission> subItemPermission in subItemPermissions)
            {
                string zoneName = subItemPermission.Key;

                if (_dnsServer.AuthZoneManager.GetAuthZoneInfo(zoneName) is null)
                    permission.RemoveAllSubItemPermissions(zoneName); //no such zone exists; remove permissions
            }

            //add missing admin permissions
            IReadOnlyList<AuthZoneInfo> zones = _dnsServer.AuthZoneManager.GetAllZones();
            Group admins = _authManager.GetGroup(Group.ADMINISTRATORS);
            if (admins is null)
                throw new DnsWebServiceException("Failed to find 'Administrators' group: auth.config file is probably corrupt.");

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Restore auth.config from a known-good backup.
2. Recreate the Zones permission section via the Web Service settings UI/API so GetPermission(PermissionSection.Zones) is non-null.
3. Delete auth.config and let the server regenerate defaults on next start, then reconfigure users/groups.
4. Check disk free space / permissions so the config file is not silently truncated on save.

Example fix

// before
Permission permission = _authManager.GetPermission(PermissionSection.Zones);
if (permission is null)
    throw new DnsWebServiceException("Failed to read 'Zones' permissions: auth.config file is probably corrupt.");

// after (call site guard)
Permission permission = _authManager.GetPermission(PermissionSection.Zones);
if (permission is null)
    permission = _authManager.CreatePermissionSection(PermissionSection.Zones); // repair instead of throw

// Before triggering permissions reconciliation, confirm the section exists
if (_authManager.GetPermission(PermissionSection.Zones) is null)
{
    // repair or restore auth.config before continuing
}

null

try
{
    _dnsWebService.Start(); // or the routine that triggers InspectAndFixZonePermissions
}
catch (DnsWebServiceException ex) when (ex.Message.Contains("'Zones' permissions"))
{
    // restore auth.config from backup, then restart
    logger.LogError("auth.config missing Zones section: {Msg}", ex.Message);
}

When it happens

Trigger: Server startup or config-save path that calls InspectAndFixZonePermissions while auth.config has no Zones permission section. Triggered after a manual edit, partial restore, or migration that dropped the section.

Common situations: Restoring an auth.config from an older incompatible version; hand-editing auth.config and removing the Zones block; filesystem corruption or truncated write; migrating between Technitium major versions without the config upgrade path.

Related errors

• Failed to find 'Administrators' group: auth.config file is p
• Failed to find 'DNS Administrators' group: auth.config file
• Web Service config file format is invalid.
• Web Service config version not supported.
• Invalid token or session expired.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/ee77631c66476b90. Report an issue: GitHub.