TechnitiumSoftware/DnsServer · error · DnsServerException

No such primary zone was found

Error message

No such primary zone was found: <zoneName>

What it means

Thrown by SignPrimaryZone when _root.TryGet cannot find the zone, or the found zone is not a PrimaryZone. DNSSEC signing is only defined for authoritative Primary zones; Secondary/Stub/Forwarder/Catalog zones cannot be signed locally. The combined guard at line 1917 rejects both absence and wrong-type.

Solutions

1. Confirm the zone exists and is Primary via GetAuthZoneInfo(zoneName) before signing.
2. If the zone is not Primary, convert it to Primary with ConvertZoneTypeTo first.
3. Normalize/trim the zone name and re-resolve.
4. Catch DnsServerException and report the missing primary zone to the caller.

Example fix

// before
manager.SignPrimaryZone(zoneName, ksk, zsk, ttl, false); // throws if not primary

// after
var info = manager.GetAuthZoneInfo(zoneName);
if (info is null || info.Type != AuthZoneType.Primary)
    return BadRequest($"'{zoneName}' is not a Primary zone; cannot sign.");
manager.SignPrimaryZone(zoneName, ksk, zsk, ttl, false);

var info = manager.GetAuthZoneInfo(zoneName);
if (info is null || info.Type != AuthZoneType.Primary)
    return BadRequest($"'{zoneName}' is not a Primary zone; cannot sign.");

static bool IsPrimaryZone(AuthZoneInfo z) => z?.Type == AuthZoneType.Primary;

try { manager.SignPrimaryZone(zoneName, ksk, zsk, ttl, false); }
catch (DnsServerException ex) when (ex.Message.StartsWith("No such primary zone")) { return NotFound(ex.Message); }

When it happens

Trigger: Calling SignPrimaryZone(zoneName, ksk, zsk, dnsKeyTtl, useNSec3, iterations, saltLength) where zoneName is unknown or names a non-Primary zone.

Common situations: Signing a zone that was converted to Forwarder/Secondary, or deleted. Passing a Secondary zone name to the signing API. Typo or stale cached zone name.

Related errors

• Cannot add DNSSEC record.
• Cannot add record: disabling records in a signed zones is…
• Cannot delete DNSSEC records.
• Cannot set DNSSEC records.
• Cannot set records: disabling records in a signed zones is…

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/90f4d794db0b63b5. Report an issue: GitHub.

Appendix: source

Thrown at DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs:1918

                            SaveZoneFile(currentCatalogZone.Name);
                        }
                    }

                    break;

                default:
                    throw new NotSupportedException();
            }
        }

        #endregion

        #region DNSSEC

        public void SignPrimaryZone(string zoneName, DnssecPrivateKey kskPrivateKey, DnssecPrivateKey zskPrivateKey, uint dnsKeyTtl, bool useNSec3, ushort iterations = 0, byte saltLength = 0)
        {
            if (!_root.TryGet(zoneName, out ApexZone apexZone) || (apexZone is not PrimaryZone primaryZone))
                throw new DnsServerException("No such primary zone was found: " + zoneName);

            primaryZone.SignZone(kskPrivateKey, zskPrivateKey, dnsKeyTtl, useNSec3, iterations, saltLength);

            SaveZoneFile(primaryZone.Name);
        }

        public void UnsignPrimaryZone(string zoneName)
        {
            if (!_root.TryGet(zoneName, out ApexZone apexZone) || (apexZone is not PrimaryZone primaryZone))
                throw new DnsServerException("No such primary zone was found: " + zoneName);

            primaryZone.UnsignZone();

            SaveZoneFile(primaryZone.Name);
        }

        public void ConvertPrimaryZoneToNSEC(string zoneName)
        {

View on GitHub (pinned to d0484b6c1e)