TechnitiumSoftware/DnsServer · error · InvalidOperationException

Network group map contains an invalid network address: {strN

Error message

Network group map contains an invalid network address: {strNetworkAddress}

What it means

The SplitHorizonApp builds a map from network addresses (CIDR strings) to group names via the 'networkGroupMap' config key. Each key is parsed with NetworkAddress.TryParse; if a key is not a valid network/CIDR expression this InvalidOperationException is thrown. NetworkAddress expects a well-formed IP prefix like '10.0.0.0/8' or 'fe80::/64'.

Source

Thrown at Apps/SplitHorizonApp/AddressTranslation.cs:197

                if (!jsonConfig.TryReadObjectAsMap("domainGroupMap", delegate (string domain, JsonElement jsonGroupName)
                    {
                        return new Tuple<string, string>(domain, jsonGroupName.GetString());
                    }, out _domainGroupMap))
                {
                    _domainGroupMap = new Dictionary<string, string>(1)
                    {
                        { "example.com", "local1" }
                    };

                    config = config.Replace("\"networkGroupMap\": ", "\"domainGroupMap\": {\r\n        \"example.com\": \"local1\"\r\n    },\r\n    \"networkGroupMap\": ");
                    await File.WriteAllTextAsync(Path.Combine(dnsServer.ApplicationFolder, "dnsApp.config"), config);
                }

                _networkGroupMap = jsonConfig.ReadObjectAsMap("networkGroupMap", delegate (string strNetworkAddress, JsonElement jsonGroupName)
                {
                    if (!NetworkAddress.TryParse(strNetworkAddress, out NetworkAddress networkAddress))
                        throw new InvalidOperationException("Network group map contains an invalid network address: " + strNetworkAddress);

                    return new Tuple<NetworkAddress, string>(networkAddress, jsonGroupName.GetString());
                });

                _groups = jsonConfig.ReadArrayAsMap("groups", delegate (JsonElement jsonGroup)
                {
                    Group group = new Group(jsonGroup);
                    return new Tuple<string, Group>(group.Name, group);
                });

                break;
            }
            while (true);
        }

        public Task<DnsDatagram> PostProcessAsync(DnsDatagram request, IPEndPoint remoteEP, DnsTransportProtocol protocol, DnsDatagram response)
        {
            if (!_enableAddressTranslation)

View on GitHub (pinned to d0484b6c1e)

Solutions

Replace the offending key with a valid CIDR network, e.g. '10.0.0.0/8' or '192.168.0.0/16'.
Use full prefix-length notation even for single hosts ('203.0.113.5/32', '::1/128').
Validate each key with System.Net.IPNetwork or IPAddress.TryParse before saving.

Example fix

// before
"networkGroupMap": {
  "10.0.0.1": "local1",
  "lan-net": "local2"
}

// after
"networkGroupMap": {
  "10.0.0.0/8": "local1",
  "192.168.0.0/16": "local2"
}

Defensive patterns

Strategy: validation

Validate before calling

// Validate each networkGroupMap key before writing config
using System.Net;

static bool IsValidNetworkAddress(string s)
{
    // NetworkAddress expects CIDR; mirror with IPNetwork parse
    if (!s.Contains('/'))
        return IPAddress.TryParse(s, out _); // bare host only if you intend /32 or /128
    var parts = s.Split('/');
    return IPAddress.TryParse(parts[0], out var ip)
        && int.TryParse(parts[1], out var pl)
        && pl >= 0
        && pl <= (ip.AddressFamily == System.Net.Sockets.AddressFamily.InterNetworkV6 ? 128 : 32);
}

foreach (var key in networkGroupMap.Keys)
    if (!IsValidNetworkAddress(key))
        throw new InvalidOperationException($"Invalid network address: {key}");

Try / catch

try
{
    // load SplitHorizonApp config
}
catch (InvalidOperationException ex) when (ex.Message.StartsWith("Network group map contains an invalid network address"))
{
    // log offending config, surface to operator, keep previous config
}

Prevention

Always use CIDR notation with explicit prefix lengths in networkGroupMap.
Validate keys with IPNetwork.TryParse before deploying config.
Keep an example config with valid CIDR entries for reference.

When it happens

Trigger: The 'networkGroupMap' object in config contains a key that NetworkAddress.TryParse rejects: a bare hostname, a typoed IP, a missing prefix length, an out-of-range octet, or an invalid CIDR. The delegate throws during ReadObjectAsMap.

Common situations: Editing dnsApp.config and entering '10.0.0.1' (host, no /32), '192.168.1' (truncated), '10.x.0.0/8' (non-numeric), or a hostname like 'lan-net' as a networkGroupMap key.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/3a413d575bf3cc4c. Report an issue: GitHub.