TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

Networks cannot have more than 255 entries.

Error message

Networks cannot have more than 255 entries.

What it means

Thrown by the ZoneTransferAllowedNetworks property setter when the collection has more than 255 entries. The limit exists because zone-transfer ACLs are serialized into a single byte-counted structure (byte.MaxValue = 255). A null or empty collection is valid (clears the ACL to null).

Source

Thrown at DnsServerCore/Dns/DnsServer.cs:7206

        public DnsApplicationManager DnsApplicationManager
        { get { return _dnsApplicationManager; } }

        public IDnsCache DnsCache
        { get { return _dnsCache; } }

        public StatsManager StatsManager
        { get { return _statsManager; } }

        public IReadOnlyCollection<NetworkAddress> ZoneTransferAllowedNetworks
        {
            get { return _zoneTransferAllowedNetworks; }
            set
            {
                if ((value is null) || (value.Count == 0))
                    _zoneTransferAllowedNetworks = null;
                else if (value.Count > byte.MaxValue)
                    throw new ArgumentOutOfRangeException(nameof(ZoneTransferAllowedNetworks), "Networks cannot have more than 255 entries.");
                else
                    _zoneTransferAllowedNetworks = value;
            }
        }

        public IReadOnlyCollection<NetworkAddress> NotifyAllowedNetworks
        {
            get { return _notifyAllowedNetworks; }
            set
            {
                if ((value is null) || (value.Count == 0))
                    _notifyAllowedNetworks = null;
                else if (value.Count > byte.MaxValue)
                    throw new ArgumentOutOfRangeException(nameof(NotifyAllowedNetworks), "Networks cannot have more than 255 entries.");
                else
                    _notifyAllowedNetworks = value;
            }
        }

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Reduce the network list to 255 or fewer entries by aggregating smaller CIDRs into larger ranges.
2. Use a broader CIDR (e.g. /16) to cover many hosts with a single entry instead of listing individual /32s.
3. If the list comes from a file, trim or consolidate it before assignment.

Example fix

// before
var nets = LoadLargeCidrList(); // 300 entries
server.ZoneTransferAllowedNetworks = nets; // throws

// after
var consolidated = ConsolidateCidrs(nets); // merge into <255
server.ZoneTransferAllowedNetworks = consolidated;

if (networks != null && networks.Count > 255)
    throw new InvalidOperationException("Consolidate CIDR list to <= 255 entries.");
server.ZoneTransferAllowedNetworks = networks;

static bool IsValidAclList(IReadOnlyCollection<NetworkAddress> nets) =>
    nets is null || nets.Count <= 255;

try { server.ZoneTransferAllowedNetworks = networks; }
catch (ArgumentOutOfRangeException) { networks = ConsolidateCidrs(networks); server.ZoneTransferAllowedNetworks = networks; }

When it happens

Trigger: Assigning an IReadOnlyCollection<NetworkAddress> with Count > 255 to server.ZoneTransferAllowedNetworks.

Common situations: Loading a large allowlist from an external IP database; migrating from a system with unlimited ACL entries; dynamically generating the list from CIDR ranges without deduplication.

Related errors

• Network Access Control List cannot have more than 255 entrie
• The Zone Transfer option is invalid for {0} zones: {1}
• Cannot update DNS zone '{zoneInfo.DisplayName}': not a prima
• Cannot update reverse DNS zone '{reverseZoneInfo.DisplayName
• Port 853 is reserved for DNS-over-TLS service. Please use a

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/83e293f5c430e960. Report an issue: GitHub.