TechnitiumSoftware/DnsServer · error · ArgumentException

The Query Access option is invalid for {0} zones: {1}

Error message

The Query Access option is invalid for {0} zones: {1}

What it means

Thrown by the ForwarderZone.QueryAccess property setter when value is AuthZoneQueryAccess.AllowOnlyZoneNameServers (3) or AllowZoneNameServersAndUseSpecifiedNetworkACL (5). These two modes restrict queries to the zone's configured authoritative name servers (NS records), but a Conditional Forwarder zone is non-authoritative and carries no NS list — only a dummy SOA and a FWD record — so name-server-based ACLs are meaningless for it. Valid options for a forwarder zone are Deny(0), Allow(1), AllowOnlyPrivateNetworks(2), and UseSpecifiedNetworkACL(4). ArgumentException names the property 'QueryAccess'.

Source

Thrown at DnsServerCore/Dns/Zones/ForwarderZone.cs:309

                base.Disabled = value; //set value early to be able to use it for notify

                if (value)
                    DisableNotifyTimer();
                else
                    TriggerNotify();
            }
        }

        public override AuthZoneQueryAccess QueryAccess
        {
            get { return base.QueryAccess; }
            set
            {
                switch (value)
                {
                    case AuthZoneQueryAccess.AllowOnlyZoneNameServers:
                    case AuthZoneQueryAccess.AllowZoneNameServersAndUseSpecifiedNetworkACL:
                        throw new ArgumentException("The Query Access option is invalid for " + GetZoneTypeName() + " zones: " + value.ToString(), nameof(QueryAccess));
                }

                base.QueryAccess = value;
            }
        }

        public override AuthZoneTransfer ZoneTransfer
        {
            get { return base.ZoneTransfer; }
            set
            {
                switch (value)
                {
                    case AuthZoneTransfer.AllowOnlyZoneNameServers:
                    case AuthZoneTransfer.AllowZoneNameServersAndUseSpecifiedNetworkACL:
                        throw new ArgumentException("The Zone Transfer option is invalid for " + GetZoneTypeName() + " zones: " + value.ToString(), nameof(ZoneTransfer));
                }

View on GitHub (pinned to d0484b6c1e)

Solutions

1. For a ForwarderZone use only Deny, Allow, AllowOnlyPrivateNetworks, or UseSpecifiedNetworkACL for QueryAccess.
2. Filter the offered enum values by zone type in your UI/API before assignment.
3. If you need NS-based query restriction, use a primary or stub zone instead of a conditional forwarder.

Example fix

// before
zone.QueryAccess = AuthZoneQueryAccess.AllowOnlyZoneNameServers;

// after
zone.QueryAccess = AuthZoneQueryAccess.UseSpecifiedNetworkACL; // valid for forwarder

var valid = new[] { AuthZoneQueryAccess.Deny, AuthZoneQueryAccess.Allow, AuthZoneQueryAccess.AllowOnlyPrivateNetworks, AuthZoneQueryAccess.UseSpecifiedNetworkACL };
if (!valid.Contains(value)) throw new ArgumentException($"QueryAccess {value} not valid for forwarder zone.");
zone.QueryAccess = value;

static bool IsValidForwarderQueryAccess(AuthZoneQueryAccess v) => v == AuthZoneQueryAccess.Deny || v == AuthZoneQueryAccess.Allow || v == AuthZoneQueryAccess.AllowOnlyPrivateNetworks || v == AuthZoneQueryAccess.UseSpecifiedNetworkACL;

try { zone.QueryAccess = value; }
catch (ArgumentException) { /* value was name-server based; fall back to UseSpecifiedNetworkACL */ zone.QueryAccess = AuthZoneQueryAccess.UseSpecifiedNetworkACL; }

When it happens

Trigger: Assigning zone.QueryAccess = AuthZoneQueryAccess.AllowOnlyZoneNameServers (or ...AndUseSpecifiedNetworkACL) on a ForwarderZone, typically via the zone-settings HTTP API or a config import that copied query-access from a primary zone.

Common situations: Cloning zone settings from a Primary/Secondary zone into a forwarder zone during bulk config; UI that shows all six options for every zone type without filtering; importing a JSON config that does not model zone-type-specific option sets.

Related errors

• The Zone Transfer option is invalid for {0} zones: {1}
• The Dynamic Updates option is invalid for {0} zones: {1}
• The Notify option is invalid for {0} zones: {1}
• Networks cannot have more than 255 entries.
• Unix Domain Sockets (UDS) are supported only on Linux, Windo

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/359f2c4c880c0e6d. Report an issue: GitHub.