TechnitiumSoftware/DnsServer · error · DnsServerException

No such primary zone was found: {zoneName}

Error message

No such primary zone was found: {zoneName}

What it means

Thrown by DeletePrimaryZoneDnssecPrivateKey when removing a DNSSEC key by keyTag. The zone must exist and be a PrimaryZone. This is the cleanup path for key lifecycle management; the error indicates the zone prerequisite is unmet before any key deletion logic runs.

Source

Thrown at DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs:2012

            SaveZoneFile(primaryZone.Name);
        }

        public DnssecPrivateKey UpdatePrimaryZoneDnssecPrivateKey(string zoneName, ushort keyTag, ushort rolloverDays)
        {
            if (!_root.TryGet(zoneName, out ApexZone apexZone) || (apexZone is not PrimaryZone primaryZone))
                throw new DnsServerException("No such primary zone was found: " + zoneName);

            DnssecPrivateKey privateKey = primaryZone.UpdatePrivateKey(keyTag, rolloverDays);

            SaveZoneFile(primaryZone.Name);

            return privateKey;
        }

        public void DeletePrimaryZoneDnssecPrivateKey(string zoneName, ushort keyTag)
        {
            if (!_root.TryGet(zoneName, out ApexZone apexZone) || (apexZone is not PrimaryZone primaryZone))
                throw new DnsServerException("No such primary zone was found: " + zoneName);

            primaryZone.DeletePrivateKey(keyTag);

            SaveZoneFile(primaryZone.Name);
        }

        public void PublishAllGeneratedPrimaryZoneDnssecPrivateKeys(string zoneName)
        {
            if (!_root.TryGet(zoneName, out ApexZone apexZone) || (apexZone is not PrimaryZone primaryZone))
                throw new DnsServerException("No such primary zone was found: " + zoneName);

            primaryZone.PublishAllGeneratedKeys();

            SaveZoneFile(primaryZone.Name);
        }

        public void ActivatePrimaryZoneKskDnsKey(string zoneName, ushort keyTag)
        {

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Check GetAuthZoneInfo(zoneName) for non-null and Type == Primary before attempting deletion.
2. If the zone was intentionally removed, skip or log the deletion call rather than throwing.
3. Verify the keyTag belongs to this zone by listing keys first (GetPrimaryZoneDnssecPrivateKeys or equivalent).
4. Ensure zone file integrity so the zone loads at startup.

Example fix

// before
authZoneManager.DeletePrimaryZoneDnssecPrivateKey("example.com", keyTag);

// after
AuthZoneInfo info = authZoneManager.GetAuthZoneInfo("example.com");
if (info is null || info.Type != AuthZoneType.Primary)
{
    _logger.LogWarning("Skipping key deletion: zone '{Zone}' is missing or not primary.", "example.com");
    return;
}
authZoneManager.DeletePrimaryZoneDnssecPrivateKey(info.Name, keyTag);

AuthZoneInfo info = authZoneManager.GetAuthZoneInfo(zoneName);
if (info is null || info.Type != AuthZoneType.Primary)
{
    logger.LogInformation("Skipping key deletion: zone '{Zone}' is not primary.", zoneName);
    return;
}

static bool IsPrimaryZone(AuthZoneManager mgr, string zoneName)
    => mgr.GetAuthZoneInfo(zoneName) is { Type: AuthZoneType.Primary };

try
{
    authZoneManager.DeletePrimaryZoneDnssecPrivateKey(zoneName, keyTag);
}
catch (DnsServerException ex) when (ex.Message.StartsWith("No such primary zone was found"))
{
    logger.LogInformation("Key deletion skipped for '{Zone}': zone gone or not primary.", zoneName);
}

When it happens

Trigger: Calling DeletePrimaryZoneDnssecPrivateKey(zoneName, keyTag) where the zone is missing or not primary. This can happen during automated key retirement scripts that run after a zone was deleted or re-typed, or when the keyTag belongs to a key on a different zone.

Common situations: Post-migration cleanup scripts referencing old zone names; zone deleted but cleanup job still running; attempting to delete a key on a secondary zone (which never owned local keys); stale configuration in an orchestration tool.

Related errors

• Cannot delete DNSSEC records.
• Cannot update DNSSEC records.
• Cannot update record: disabling records in a signed zones is
• The record type is not supported by DNSSEC signed primary zo
• Cannot set records: disabling records in a signed zones is n

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/47bb6378b0b4cd6e. Report an issue: GitHub.