TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

NSEC3 iterations valid range is 0-50

Error message

NSEC3 iterations valid range is 0-50

What it means

Thrown by the collection overload PrimaryZone.SignZone when useNSec3 is true and iterations > 50. NSEC3 hash iterations above 50 are rejected (RFC 5151 operational guidance + DoS-amplification concerns) via ArgumentOutOfRangeException(nameof(iterations)) before key validation.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:483

                else
                {
                    salt = [];
                }
            }

            SignZone([kskPrivateKey, zskPrivateKey], dnsKeyTtl, useNSec3, iterations, salt);
        }

        public void SignZone(IReadOnlyCollection<DnssecPrivateKey> dnssecPrivateKeys, uint dnsKeyTtl, bool useNSec3, ushort iterations = 0, byte[] salt = null)
        {
            //do validations
            if (_dnssecStatus != AuthZoneDnssecStatus.Unsigned)
                throw new DnsServerException("Cannot sign zone: the zone is already signed.");

            if (useNSec3)
            {
                if (iterations > 50)
                    throw new ArgumentOutOfRangeException(nameof(iterations), "NSEC3 iterations valid range is 0-50");

                if (salt.Length > 32)
                    throw new ArgumentOutOfRangeException(nameof(salt), "NSEC3 salt length valid range is 0-32");
            }

            bool foundKsk = false;
            bool foundZsk = false;

            foreach (DnssecPrivateKey dnssecPrivateKey in dnssecPrivateKeys)
            {
                switch (dnssecPrivateKey.KeyType)
                {
                    case DnssecPrivateKeyType.KeySigningKey:
                        foundKsk = true;
                        break;

                    case DnssecPrivateKeyType.ZoneSigningKey:
                        foundZsk = true;

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Pass iterations in 0-50; 0 or 1 is the modern recommendation.
2. Prefer NSEC over NSEC3 with high iterations if denial-of-existence is the only concern.
3. Clamp the requested value to the valid range before calling.

Example fix

// before
zone.SignZone(keys, ttl, useNSec3: true, iterations: 100);

// after
ushort iterations = (ushort)Math.Clamp(requestedIterations, 0, 50);
zone.SignZone(keys, ttl, useNSec3: true, iterations: iterations);

if (iterations > 50) throw new ArgumentOutOfRangeException(nameof(iterations));
zone.SignZone(keys, ttl, useNSec3: true, iterations, salt);

static bool IsValidNsec3Iterations(int n) => n >= 0 && n <= 50;

When it happens

Trigger: zone.SignZone(keys, ttl, useNSec3: true, iterations: 100).

Common situations: Copying an iterations count from a security-hardening guide for a different algorithm; legacy zones migrated with high iterations.

Related errors

• NSEC3 salt length valid range is 0-32
• Cannot delete DNSSEC records.
• Cannot update DNSSEC records.
• Cannot update record: disabling records in a signed zones is
• The private key must be a Key Signing Key.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/f5a15d4f9554730a. Report an issue: GitHub.