TechnitiumSoftware/DnsServer · error · ArgumentException

The Query Access option is invalid for Secondary Conditional

Error message

The Query Access option is invalid for Secondary Conditional Forwarder zones: {value}

What it means

Thrown by the SecondaryForwarderZone.QueryAccess setter when value is AllowOnlyZoneNameServers or AllowZoneNameServersAndUseSpecifiedNetworkACL. A secondary conditional-forwarder zone has no authoritative name-server list of its own (it forwards), so the name-server-based query-access modes are meaningless and rejected with ArgumentException.

Source

Thrown at DnsServerCore/Dns/Zones/SecondaryForwarderZone.cs:111

            set { throw new InvalidOperationException(); }
        }

        public override bool OverrideCatalogPrimaryNameServers
        {
            get { throw new InvalidOperationException(); }
            set { throw new InvalidOperationException(); }
        }

        public override AuthZoneQueryAccess QueryAccess
        {
            get { return base.QueryAccess; }
            set
            {
                switch (value)
                {
                    case AuthZoneQueryAccess.AllowOnlyZoneNameServers:
                    case AuthZoneQueryAccess.AllowZoneNameServersAndUseSpecifiedNetworkACL:
                        throw new ArgumentException("The Query Access option is invalid for Secondary Conditional Forwarder zones: " + value.ToString(), nameof(QueryAccess));
                }

                base.QueryAccess = value;
            }
        }

        public override AuthZoneTransfer ZoneTransfer
        {
            get { return base.ZoneTransfer; }
            set { throw new InvalidOperationException(); }
        }

        public override AuthZoneNotify Notify
        {
            get { return base.Notify; }
            set { throw new InvalidOperationException(); }
        }

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Use Deny, Allow, AllowOnlyPrivateNetworks, or UseSpecifiedNetworkACL for a secondary forwarder zone.
2. Branch query-access assignment by zone type so forwarders never get name-server modes.
3. Strip name-server ACL modes when cloning zone options into a forwarder.

Example fix

// before
zone.QueryAccess = AuthZoneQueryAccess.AllowOnlyZoneNameServers;

// after
zone.QueryAccess = AuthZoneQueryAccess.UseSpecifiedNetworkACL;

static readonly HashSet<AuthZoneQueryAccess> ForwarderValid = new()
{
    AuthZoneQueryAccess.Deny, AuthZoneQueryAccess.Allow,
    AuthZoneQueryAccess.AllowOnlyPrivateNetworks, AuthZoneQueryAccess.UseSpecifiedNetworkACL
};
if (ForwarderValid.Contains(value)) zone.QueryAccess = value;

static bool IsValidForForwarder(AuthZoneQueryAccess v) =>
    v != AuthZoneQueryAccess.AllowOnlyZoneNameServers &&
    v != AuthZoneQueryAccess.AllowZoneNameServersAndUseSpecifiedNetworkACL;

null

When it happens

Trigger: Setting zone.QueryAccess on a SecondaryForwarderZone (Secondary Conditional Forwarder) to one of the two name-server-based ACL modes.

Common situations: Applying a uniform query-access policy to all zones including forwarders; importing settings from a primary/secondary zone into a forwarder zone.

Related errors

• The Dynamic Updates option is invalid for Secondary Conditio
• The Notify option is invalid for {zoneType} zones: {value}
• At least one primary name server address must be specified f
• Cannot update DNS zone '{zoneInfo.DisplayName}': not a prima
• Cannot update reverse DNS zone '{reverseZoneInfo.DisplayName

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/ad1cd2de06dc8fbd. Report an issue: GitHub.