TechnitiumSoftware/DnsServer · error · DnsServerException

The record type is not supported by DNSSEC signed primary zo

Error message

The record type is not supported by DNSSEC signed primary zones.

What it means

Thrown by PrimarySubDomainZone.SetRecords() when the parent primary zone is DNSSEC-signed (DnssecStatus != Unsigned) and the requested type is ANAME or APP. ANAME and APP records are resolved dynamically by the server (ANAME resolves an address, APP delegates to an app plugin), so their answers are not stable RRsets that can be cryptographically signed — adding them to a signed zone would break DNSSEC validation. The guard fires before any record is written. DnsServerException (domain error, catchable).

Source

Thrown at DnsServerCore/Dns/Zones/PrimarySubDomainZone.cs:64

        internal override IReadOnlyList<DnsResourceRecord> SignRRSet(IReadOnlyList<DnsResourceRecord> records)
        {
            return _primaryZone.SignRRSet(records);
        }

        #endregion

        #region public

        public override void SetRecords(DnsResourceRecordType type, IReadOnlyList<DnsResourceRecord> records)
        {
            if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)
            {
                switch (type)
                {
                    case DnsResourceRecordType.ANAME:
                    case DnsResourceRecordType.APP:
                        throw new DnsServerException("The record type is not supported by DNSSEC signed primary zones.");

                    default:
                        foreach (DnsResourceRecord record in records)
                        {
                            if (record.GetAuthGenericRecordInfo().Disabled)
                                throw new DnsServerException("Cannot set records: disabling records in a signed zones is not supported.");
                        }

                        break;
                }
            }

            switch (type)
            {
                case DnsResourceRecordType.SOA:
                    throw new InvalidOperationException("Cannot set SOA record on sub domain.");

                case DnsResourceRecordType.DNSKEY:

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Do not use ANAME or APP records in a DNSSEC-signed zone; replace ANAME with static A/AAAA records.
2. If ANAME dynamic resolution is required, disable DNSSEC signing on that primary zone.
3. Filter ANAME/APP out of the record set before calling SetRecords when DnssecStatus != Unsigned.

Example fix

// before
zone.SetRecords(DnsResourceRecordType.ANAME, new[] { anameRecord });

// after
if (primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)
    zone.SetRecords(DnsResourceRecordType.A, new[] { staticARecord }); // signable type
else
    zone.SetRecords(DnsResourceRecordType.ANAME, new[] { anameRecord });

if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned && (type == DnsResourceRecordType.ANAME || type == DnsResourceRecordType.APP))
    throw new InvalidOperationException("ANAME/APP not supported in signed zones; use A/AAAA.");
zone.SetRecords(type, records);

static bool IsSignableRecordType(DnsResourceRecordType type, AuthZoneDnssecStatus status) => status == AuthZoneDnssecStatus.Unsigned || (type != DnsResourceRecordType.ANAME && type != DnsResourceRecordType.APP);

try { zone.SetRecords(type, records); }
catch (DnsServerException ex) when (ex.Message.Contains("DNSSEC signed primary zones")) { /* switch to static A/AAAA or disable signing */ }

When it happens

Trigger: zone.SetRecords(DnsResourceRecordType.ANAME, records) or SetRecords(DnsResourceRecordType.APP, ...) on a PrimarySubDomainZone whose parent PrimaryZone.DnssecStatus is SignedWithNSEC or SignedWithNSEC3. Happens when DNSSEC is enabled on a zone that already contains, or is being loaded with, ANAME/APP records.

Common situations: Turning on DNSSEC signing on a primary zone that uses ANAME for dynamic IP scenarios; importing a zone file containing ANAME records into a signed zone; app-based (APP) records combined with signing.

Related errors

• Cannot set records: disabling records in a signed zones is n
• Cannot add record: disabling records in a signed zones is no
• Cannot set DNSSEC records.
• The record type is not supported by primary zones.
• Cannot set records: TTL cannot be greater than SOA EXPIRE.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/bdb01cbe321b1d05. Report an issue: GitHub.