TechnitiumSoftware/DnsServer · error · DnsServerException

No such primary zone was found: <zoneName>

Error message

No such primary zone was found: <zoneName>

What it means

Thrown by SignPrimaryZone when _root.TryGet cannot find the zone, or the found zone is not a PrimaryZone. DNSSEC signing is only defined for authoritative Primary zones; Secondary/Stub/Forwarder/Catalog zones cannot be signed locally. The combined guard at line 1917 rejects both absence and wrong-type.

Source

Thrown at DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs:1918

                            SaveZoneFile(currentCatalogZone.Name);
                        }
                    }

                    break;

                default:
                    throw new NotSupportedException();
            }
        }

        #endregion

        #region DNSSEC

        public void SignPrimaryZone(string zoneName, DnssecPrivateKey kskPrivateKey, DnssecPrivateKey zskPrivateKey, uint dnsKeyTtl, bool useNSec3, ushort iterations = 0, byte saltLength = 0)
        {
            if (!_root.TryGet(zoneName, out ApexZone apexZone) || (apexZone is not PrimaryZone primaryZone))
                throw new DnsServerException("No such primary zone was found: " + zoneName);

            primaryZone.SignZone(kskPrivateKey, zskPrivateKey, dnsKeyTtl, useNSec3, iterations, saltLength);

            SaveZoneFile(primaryZone.Name);
        }

        public void UnsignPrimaryZone(string zoneName)
        {
            if (!_root.TryGet(zoneName, out ApexZone apexZone) || (apexZone is not PrimaryZone primaryZone))
                throw new DnsServerException("No such primary zone was found: " + zoneName);

            primaryZone.UnsignZone();

            SaveZoneFile(primaryZone.Name);
        }

        public void ConvertPrimaryZoneToNSEC(string zoneName)
        {

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Confirm the zone exists and is Primary via GetAuthZoneInfo(zoneName) before signing.
2. If the zone is not Primary, convert it to Primary with ConvertZoneTypeTo first.
3. Normalize/trim the zone name and re-resolve.
4. Catch DnsServerException and report the missing primary zone to the caller.

Example fix

// before
manager.SignPrimaryZone(zoneName, ksk, zsk, ttl, false); // throws if not primary

// after
var info = manager.GetAuthZoneInfo(zoneName);
if (info is null || info.Type != AuthZoneType.Primary)
    return BadRequest($"'{zoneName}' is not a Primary zone; cannot sign.");
manager.SignPrimaryZone(zoneName, ksk, zsk, ttl, false);

var info = manager.GetAuthZoneInfo(zoneName);
if (info is null || info.Type != AuthZoneType.Primary)
    return BadRequest($"'{zoneName}' is not a Primary zone; cannot sign.");

static bool IsPrimaryZone(AuthZoneInfo z) => z?.Type == AuthZoneType.Primary;

try { manager.SignPrimaryZone(zoneName, ksk, zsk, ttl, false); }
catch (DnsServerException ex) when (ex.Message.StartsWith("No such primary zone")) { return NotFound(ex.Message); }

When it happens

Trigger: Calling SignPrimaryZone(zoneName, ksk, zsk, dnsKeyTtl, useNSec3, iterations, saltLength) where zoneName is unknown or names a non-Primary zone.

Common situations: Signing a zone that was converted to Forwarder/Secondary, or deleted. Passing a Secondary zone name to the signing API. Typo or stale cached zone name.

Related errors

• The record type is not supported by DNSSEC signed primary zo
• Cannot set records: disabling records in a signed zones is n
• Cannot set DNSSEC records.
• Cannot add record: disabling records in a signed zones is no
• Cannot add DNSSEC record.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/90f4d794db0b63b5. Report an issue: GitHub.