What causes "The record type is not supported by DNSSEC signed primary zones." in TechnitiumSoftware/DnsServer?

Do not set ANAME or APP records on a signed primary zone; use standard A/AAAA records instead.

TechnitiumSoftware/DnsServer · error · DnsServerException

The record type is not supported by DNSSEC signed primary zo

Error message

The record type is not supported by DNSSEC signed primary zones.

What it means

Thrown by PrimaryZone.SetRecords() when the zone is DNSSEC-signed (_dnssecStatus != Unsigned) and the requested record type is ANAME or APP. ANAME and APP are synthesized/algorithmic records maintained by the server, and signing their changing values into DNSSEC (RRSIG/NSEC) is unsupported, so a signed primary zone refuses to store them directly.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:2516

        #endregion

        #region public

        public override string GetZoneTypeName()
        {
            return "Primary";
        }

        public override void SetRecords(DnsResourceRecordType type, IReadOnlyList<DnsResourceRecord> records)
        {
            if (_dnssecStatus != AuthZoneDnssecStatus.Unsigned)
            {
                switch (type)
                {
                    case DnsResourceRecordType.ANAME:
                    case DnsResourceRecordType.APP:
                        throw new DnsServerException("The record type is not supported by DNSSEC signed primary zones.");

                    default:
                        foreach (DnsResourceRecord record in records)
                        {
                            if (record.GetAuthGenericRecordInfo().Disabled)
                                throw new DnsServerException("Cannot set records: disabling records in a signed zones is not supported.");
                        }

                        break;
                }
            }

            switch (type)
            {
                case DnsResourceRecordType.CNAME:
                case DnsResourceRecordType.DS:
                    throw new InvalidOperationException("Cannot set " + type.ToString() + " record at zone apex.");

View on GitHub (pinned to d0484b6c1e)

Solutions

Do not set ANAME or APP records on a signed primary zone; use standard A/AAAA records instead.
If ANAME/APP functionality is required, keep the zone unsigned.
Strip ANAME/APP records from the input set before calling SetRecords on a signed zone.

Example fix

// before
zone.SetRecords(DnsResourceRecordType.ANAME, anameRecords); // signed zone rejects

// after
zone.SetRecords(DnsResourceRecordType.A, resolvedARecords); // use concrete records on signed zone

Defensive patterns

Strategy: validation

Validate before calling

// Reject ANAME/APP before SetRecords on a signed zone.
if (IsZoneSigned(zone) && (type == DnsResourceRecordType.ANAME || type == DnsResourceRecordType.APP))
    throw new ArgumentException("ANAME/APP not supported on signed zones; use A/AAAA.");

zone.SetRecords(type, records);

Type guard

static bool IsTypeAllowedOnSignedZone(DnsResourceRecordType t) =>
    t != DnsResourceRecordType.ANAME && t != DnsResourceRecordType.APP;

Try / catch

try { zone.SetRecords(type, records); }
catch (DnsServerException ex) when (ex.Message.Contains("not supported by DNSSEC signed primary zones"))
{ Log.Error($"Unsupported type on signed zone: {type}"); }

Prevention

Convert ANAME/APP to concrete A/AAAA before signing a zone.
Classify record types as user-managed vs algorithmic in import tooling.
Gate signed-zone writes through an allow-list of record types.

When it happens

Trigger: Calling SetRecords(DnsResourceRecordType.ANAME, ...) or SetRecords(DnsResourceRecordType.APP, ...) on a primary zone whose _dnssecStatus is SignedWithNSEC or SignedWithNSEC3.

Common situations: Migrating a zone that previously used ANAME/APP records into DNSSEC signing without removing those records first; automation that blindly copies a full zone template including ANAME entries onto a signed zone.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/4e86ccddb4f53354. Report an issue: GitHub.