TechnitiumSoftware/DnsServer · error · ArgumentException

The Dynamic Updates option is invalid for Secondary Conditio

Error message

The Dynamic Updates option is invalid for Secondary Conditional Forwarder zones: {}

What it means

Thrown by the SecondaryForwarderZone.Update setter when value is AllowOnlyZoneNameServers or AllowZoneNameServersAndUseSpecifiedNetworkACL. Dynamic updates are not authored on a secondary conditional forwarder (no name-server authority), so those modes are invalid; ArgumentException names the value.

Source

Thrown at DnsServerCore/Dns/Zones/SecondaryForwarderZone.cs:139

            set { throw new InvalidOperationException(); }
        }

        public override AuthZoneNotify Notify
        {
            get { return base.Notify; }
            set { throw new InvalidOperationException(); }
        }

        public override AuthZoneUpdate Update
        {
            get { return base.Update; }
            set
            {
                switch (value)
                {
                    case AuthZoneUpdate.AllowOnlyZoneNameServers:
                    case AuthZoneUpdate.AllowZoneNameServersAndUseSpecifiedNetworkACL:
                        throw new ArgumentException("The Dynamic Updates option is invalid for Secondary Conditional Forwarder zones: " + value.ToString(), nameof(Update));
                }

                base.Update = value;
            }
        }

        public override IReadOnlyList<NameServerAddress> PrimaryNameServerAddresses
        {
            get { return base.PrimaryNameServerAddresses; }
            set
            {
                if ((value is null) || (value.Count == 0))
                    throw new ArgumentException("At least one primary name server address must be specified for " + GetZoneTypeName() + " zone.", nameof(PrimaryNameServerAddresses));

                base.PrimaryNameServerAddresses = value;
            }
        }

View on GitHub (pinned to d0484b6c1e)

Solutions

Use Deny, Allow, AllowOnlyZoneNameServers-excluded, or UseSpecifiedNetworkACL as appropriate; for a forwarder prefer Deny.
Gate Update assignment by zone type.
Do not propagate name-server dynamic-update modes to forwarder zones.

Example fix

// before
zone.Update = AuthZoneUpdate.AllowOnlyZoneNameServers;

// after
zone.Update = AuthZoneUpdate.Deny;

Defensive patterns

Strategy: type-guard

Validate before calling

static readonly HashSet<AuthZoneUpdate> ForwarderValid = new()
{
    AuthZoneUpdate.Deny, AuthZoneUpdate.Allow, AuthZoneUpdate.UseSpecifiedNetworkACL
};
if (ForwarderValid.Contains(value)) zone.Update = value;

Type guard

static bool IsValidForForwarder(AuthZoneUpdate v) =>
    v != AuthZoneUpdate.AllowOnlyZoneNameServers &&
    v != AuthZoneUpdate.AllowZoneNameServersAndUseSpecifiedNetworkACL;

Try / catch

null

Prevention

Prefer AuthZoneUpdate.Deny for secondary forwarder zones.
Gate dynamic-update assignment by zone type.

When it happens

Trigger: Setting zone.Update (Dynamic Updates) on a SecondaryForwarderZone to a name-server-based mode.

Common situations: Pushing a global dynamic-updates policy to every zone; copying update settings from an authoritative primary into a forwarder.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/5ed91a8d4743650e. Report an issue: GitHub.