TechnitiumSoftware/DnsServer · error · DnsServerException

Failed to set DNSSEC records. Please try again.

Error message

Failed to set DNSSEC records. Please try again.

What it means

Thrown by the private EnableNSec helper when zone.TrySetRecords for the NSEC RRset returns false during signing or NSEC re-enabling. The false result means the zone could not atomically commit the freshly computed NSEC records (typically a concurrent write or an integrity check inside the zone), so the library aborts with a 'please try again' message.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:834

            List<DnsResourceRecord> deletedRecords = new List<DnsResourceRecord>();

            uint ttl = GetZoneSoaMinimum();

            for (int i = 0; i < zones.Count; i++)
            {
                AuthZone zone = zones[i];
                AuthZone nextZone;

                if (i < zones.Count - 1)
                    nextZone = zones[i + 1];
                else
                    nextZone = zones[0];

                IReadOnlyList<DnsResourceRecord> newNSecRecords = zone.GetUpdatedNSecRRSet(nextZone.Name, ttl);
                if (newNSecRecords.Count > 0)
                {
                    if (!zone.TrySetRecords(DnsResourceRecordType.NSEC, newNSecRecords, out IReadOnlyList<DnsResourceRecord> deletedNSecRecords))
                        throw new DnsServerException("Failed to set DNSSEC records. Please try again.");

                    addedRecords.AddRange(newNSecRecords);
                    deletedRecords.AddRange(deletedNSecRecords);

                    IReadOnlyList<DnsResourceRecord> newRRSigRecords = SignRRSet(newNSecRecords);
                    if (newRRSigRecords.Count > 0)
                    {
                        zone.AddOrUpdateRRSigRecords(newRRSigRecords, out IReadOnlyList<DnsResourceRecord> deletedRRSigRecords);

                        addedRecords.AddRange(newRRSigRecords);
                        deletedRecords.AddRange(deletedRRSigRecords);
                    }
                }
            }

            CommitAndIncrementSerial(deletedRecords, addedRecords);
        }

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Retry the signing or conversion operation; the failure path is designed to be transient.
2. Ensure no other code path is concurrently adding/removing records in the same zone during the DNSSEC operation.
3. If it persists, dump the zone's current NSEC records for the failing owner name and check for corruption.

Example fix

// before
zone.SignZone(keys, dnsKeyTtl, useNSec3: false);

// after
for (int attempt = 0; attempt < 3; attempt++)
{
    try
    {
        zone.SignZone(keys, dnsKeyTtl, useNSec3: false);
        break;
    }
    catch (DnsServerException ex) when (ex.Message.Contains("Failed to set DNSSEC records"))
    {
        if (attempt == 2) throw;
    }
}

// No pure pre-check exists; this is a transient commit failure.
// Best pre-check: avoid concurrent record mutations on the same zone.
using (await zoneLock.LockAsync())
{
    zone.SignZone(keys, dnsKeyTtl, useNSec3: false);
}

for (int attempt = 0; attempt < 3; attempt++)
{
    try
    {
        zone.SignZone(keys, dnsKeyTtl, useNSec3: false);
        break;
    }
    catch (DnsServerException ex) when (ex.Message.Contains("Failed to set DNSSEC records"))
    {
        if (attempt == 2) throw;
    }
}

When it happens

Trigger: Triggered indirectly during SignZone, ConvertToNSec3, ConvertToNSec, or RefreshNSec when TrySetRecords(NSEC, ...) fails internally for a given zone.

Common situations: High concurrency: another thread is mutating the same zone records while a DNSSEC operation is mid-flight, or a transient inconsistency between the computed NSEC RRset and the zone's current state.

Related errors

• Failed to update DNSKEY TTL. Please try again.
• Failed to add Secondary node: please try again.
• Failed to delete Secondary node: please try again.
• Cannot set records. Please try again.
• Cannot sign zone: the zone is already signed.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/f0ce8c6324eff923. Report an issue: GitHub.