TechnitiumSoftware/DnsServer · error · DnsServerException

The domain name '<domain>' does not belong to the zone: <zon

Error message

The domain name '<domain>' does not belong to the zone: <zoneName>

What it means

Thrown by AuthZoneManager.ValidateIfDomainBelongsToZone when a domain name is neither equal to the zone name, nor a child of it (does not end with '.'+zoneName), and the zone is not the root zone (zoneName.Length == 0). It enforces that record operations target a domain actually inside the named zone, preventing cross-zone writes.

Source

Thrown at DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs:693

        internal static string GetParentZone(string domain)
        {
            int i = domain.IndexOf('.');
            if (i > -1)
                return domain.Substring(i + 1);

            //dont return root zone
            return null;
        }

        internal static bool DomainBelongsToZone(string zoneName, string domain)
        {
            return domain.Equals(zoneName, StringComparison.OrdinalIgnoreCase) || domain.EndsWith("." + zoneName, StringComparison.OrdinalIgnoreCase) || (zoneName.Length == 0);
        }

        internal static void ValidateIfDomainBelongsToZone(string zoneName, string domain)
        {
            if (!DomainBelongsToZone(zoneName, domain))
                throw new DnsServerException("The domain name '" + domain + "' does not belong to the zone: " + zoneName);
        }

        #endregion

        #region auth zone tree methods

        private ApexZone CreateEmptyApexZone(AuthZoneInfo zoneInfo)
        {
            ApexZone apexZone;

            switch (zoneInfo.Type)
            {
                case AuthZoneType.Primary:
                    apexZone = new PrimaryZone(_dnsServer, zoneInfo);
                    break;

                case AuthZoneType.Secondary:
                    apexZone = new SecondaryZone(_dnsServer, zoneInfo);

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Ensure the domain is the zone apex or a sub-domain of it (domain == zoneName or domain ends with '.' + zoneName).
2. Resolve the correct zone for the domain first (longest-suffix zone match) before issuing the record operation.
3. Strip an erroneous trailing root dot or extra labels from the domain before validation.

Example fix

// before
zoneManager.AddRecord("other.com", "www.other.com", ...);

// after
if (!AuthZoneManager.DomainBelongsToZone(zoneName, domain))
    throw new ArgumentException($"{domain} not in zone {zoneName}");
zoneManager.AddRecord(zoneName, domain, ...);

void EnsureDomainInZone(string zoneName, string domain)
{
    if (!AuthZoneManager.DomainBelongsToZone(zoneName, domain))
        throw new ArgumentException($"'{domain}' is not in zone '{zoneName}'");
}
// usage:
EnsureDomainInZone(zoneName, domain);
zoneManager.AddRecord(zoneName, domain, ...);

static bool BelongsToZone(string zoneName, string domain) =>
    AuthZoneManager.DomainBelongsToZone(zoneName, domain);

When it happens

Trigger: Calling a record API (add/update/delete) with a domain that belongs to a different zone or is outside the zone's authority, after ValidateIfDomainBelongsToZone(zoneName, domain) is invoked internally.

Common situations: Trying to add 'www.other.com' into the 'example.com' zone; a missing/extra trailing label; a sub-domain delegation where the record belongs to the delegated child zone; caller passing the FQDN including a zone it does not own.

Related errors

• Zone was not found for domain: {key}
• Zone was not found for domain: <domain>
• Zone was not found: {zoneName}
• Zone does not contain SOA record.
• Failed to load DNS zone file: the zone file does not contain

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/d7deae24baf97515. Report an issue: GitHub.