TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

Network ACL cannot have more than 255 entries.

Error message

Network ACL cannot have more than 255 entries.

What it means

Thrown by the QueryAccessNetworkACL setter when the supplied NetworkAccessControl collection has more than byte.MaxValue (255) entries. Null/empty is allowed (clears the ACL); anything above 255 is rejected because the ACL is persisted with a single-byte count.

Source

Thrown at DnsServerCore/Dns/Zones/ApexZone.cs:1287

                    {
                        if (_overrideCatalogQueryAccess)
                            catalogZone.SetAllowQueryProperty(GetQueryAccessACL(), _name); //update member zone custom property
                        else
                            catalogZone.SetAllowQueryProperty(null, _name); //remove member zone custom property
                    }
                }
            }
        }

        public IReadOnlyCollection<NetworkAccessControl> QueryAccessNetworkACL
        {
            get { return _queryAccessNetworkACL; }
            set
            {
                if ((value is null) || (value.Count == 0))
                    _queryAccessNetworkACL = null;
                else if (value.Count > byte.MaxValue)
                    throw new ArgumentOutOfRangeException(nameof(QueryAccessNetworkACL), "Network ACL cannot have more than 255 entries.");
                else
                    _queryAccessNetworkACL = value;
            }
        }

        public virtual AuthZoneTransfer ZoneTransfer
        {
            get { return _zoneTransfer; }
            set
            {
                _zoneTransfer = value;

                //update catalog zone property
                if (this is CatalogZone thisCatalogZone)
                {
                    //update global custom property
                    thisCatalogZone.SetAllowTransferProperty(GetZoneTranferACL());
                }

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Reduce QueryAccessNetworkACL to <= 255 entries by aggregating subnets (e.g. combine /24s into a /16).
2. Move broad allow/deny logic to upstream firewall rules instead of the zone ACL.
3. Deduplicate overlapping rules before assigning.

Example fix

// before
zone.QueryAccessNetworkACL = allRules; // Count > 255 -> throws
// after
zone.QueryAccessNetworkACL = AggregateSubnets(allRules).Take(255).ToList();

if (acl != null && acl.Count > byte.MaxValue)
    throw new InvalidOperationException($"QueryAccessNetworkACL capped at 255 entries (got {acl.Count}).");
zone.QueryAccessNetworkACL = acl;

static bool IsValidAclCount(IReadOnlyCollection<NetworkAccessControl> acl) => acl is null || acl.Count <= byte.MaxValue;

try { zone.QueryAccessNetworkACL = acl; }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(zone.QueryAccessNetworkACL))
{ zone.QueryAccessNetworkACL = AggregateSubnets(acl).Take(byte.MaxValue).ToList(); }

When it happens

Trigger: Assigning a query-access ACL with > 255 network rules; importing a large ACL from another system.

Common situations: Granular per-subnet allow/deny lists that grew over time; merging multiple ACL sources.

Related errors

• Network Access Control List cannot have more than 255 entrie
• The domain name '<domain>' does not belong to the zone: <zon
• Invalid AXFR response was received.
• Invalid IXFR/AXFR response was received.
• Zone must be a primary or forwarder type: {apexZone}

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/07907a83d00835e6. Report an issue: GitHub.