TechnitiumSoftware/DnsServer · error · InvalidOperationException

No authoritative zone was found: {zoneName}

Error message

No authoritative zone was found: {zoneName}

What it means

Thrown by SyncIncrementalZoneTransferRecords when the zone exists (_root.TryGet succeeds) but apexZone.GetRecords(SOA).Count != 1. IXFR sync requires exactly one SOA to identify the current serial and apply incremental diffs. A zone with zero or multiple SOA records cannot be incrementally updated because the diff baseline is ambiguous.

Source

Thrown at DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs:2702

        public IReadOnlyList<DnsResourceRecord> SyncIncrementalZoneTransferRecords(string zoneName, IReadOnlyList<DnsResourceRecord> xfrRecords)
        {
            if ((xfrRecords.Count < 2) || (xfrRecords[0].Type != DnsResourceRecordType.SOA) || !xfrRecords[0].Name.Equals(zoneName, StringComparison.OrdinalIgnoreCase) || !xfrRecords[xfrRecords.Count - 1].Equals(xfrRecords[0]))
                throw new DnsServerException("Invalid IXFR/AXFR response was received.");

            if ((xfrRecords.Count < 4) || (xfrRecords[1].Type != DnsResourceRecordType.SOA))
            {
                //received AXFR response
                SyncZoneTransferRecords(zoneName, xfrRecords);
                return Array.Empty<DnsResourceRecord>();
            }

            if (!_root.TryGet(zoneName, out ApexZone apexZone))
                throw new InvalidOperationException("No such zone was found: " + zoneName);

            IReadOnlyList<DnsResourceRecord> soaRecords = apexZone.GetRecords(DnsResourceRecordType.SOA);
            if (soaRecords.Count != 1)
                throw new InvalidOperationException("No authoritative zone was found: " + zoneName);

            //process IXFR response
            DnsResourceRecord currentSoaRecord = soaRecords[0];
            DnsSOARecordData currentSoa = currentSoaRecord.RDATA as DnsSOARecordData;

            List<DnsResourceRecord> condensedXfrRecords = CondenseIncrementalZoneTransferRecords(zoneName, currentSoaRecord, xfrRecords);

            List<DnsResourceRecord> deletedRecords = new List<DnsResourceRecord>();
            List<DnsResourceRecord> deletedGlueRecords = new List<DnsResourceRecord>();
            List<DnsResourceRecord> addedRecords = new List<DnsResourceRecord>();
            List<DnsResourceRecord> addedGlueRecords = new List<DnsResourceRecord>();

            //read and apply difference sequences
            int index = 1;
            int count = condensedXfrRecords.Count - 1;

            while (index < count)
            {

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Verify the zone has exactly one SOA record before calling SyncIncrementalZoneTransferRecords.
2. If SOA is missing or duplicated, fall back to full AXFR via SyncZoneTransferRecords to rebuild the zone.
3. Repair the zone file and reload the zone from disk.
4. Check for concurrent zone modification or failed prior sync operations.

Example fix

// before
var deleted = authZoneManager.SyncIncrementalZoneTransferRecords(zoneName, xfrRecords);

// after
AuthZoneInfo info = authZoneManager.GetAuthZoneInfo(zoneName);
if (info is null)
    throw new InvalidOperationException("Zone not found.");
var soaRecords = info.ApexZone.GetRecords(DnsResourceRecordType.SOA);
if (soaRecords.Count != 1)
{
    _logger.LogError("Zone '{Zone}' has {Count} SOA records; falling back to full AXFR sync.", zoneName, soaRecords.Count);
    authZoneManager.SyncZoneTransferRecords(zoneName, xfrRecords);
    return Array.Empty<DnsResourceRecord>();
}
var deleted = authZoneManager.SyncIncrementalZoneTransferRecords(zoneName, xfrRecords);

AuthZoneInfo info = authZoneManager.GetAuthZoneInfo(zoneName);
if (info is null)
    throw new InvalidOperationException("Zone not found.");
var soaRecords = info.ApexZone.GetRecords(DnsResourceRecordType.SOA);
if (soaRecords.Count != 1)
    throw new InvalidOperationException($"Zone has {soaRecords.Count} SOA records; cannot sync IXFR.");

static bool ZoneHasSingleSoa(AuthZoneManager mgr, string zoneName)
{
    AuthZoneInfo info = mgr.GetAuthZoneInfo(zoneName);
    if (info is null) return false;
    return info.ApexZone.GetRecords(DnsResourceRecordType.SOA).Count == 1;
}

try
{
    var deleted = authZoneManager.SyncIncrementalZoneTransferRecords(zoneName, xfrRecords);
}
catch (InvalidOperationException ex) when (ex.Message.Contains("No authoritative zone was found"))
{
    logger.LogError("IXFR sync failed for '{Zone}': SOA integrity broken. Falling back to AXFR.", zoneName);
    authZoneManager.SyncZoneTransferRecords(zoneName, xfrRecords);
}

When it happens

Trigger: Calling SyncIncrementalZoneTransferRecords where the zone exists in _root but its SOA record is missing or duplicated. The zone passed the TryGet check (error 418) but fails SOA integrity. This can indicate zone corruption, a partially initialized zone, or a zone type that doesn't maintain SOA (stub).

Common situations: Zone corruption from a previous failed sync operation; zone in a partially-loaded state after restart; stub zone mistakenly receiving IXFR data; concurrent modification that left the SOA in an inconsistent state; zone file corruption causing SOA record duplication.

Related errors

• No SOA record was found for IXFR.
• Zone must be a primary, secondary, or forwarder zone.
• Invalid IXFR/AXFR response was received.
• No such zone was found: {zoneName}
• Cannot update record: use SetRecords() for updating SOA reco

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/1546b91320baeae8. Report an issue: GitHub.