TechnitiumSoftware/DnsServer · error · DnsServerException

The zone must be signed.

Error message

The zone must be signed.

What it means

Thrown by DeletePrivateKey when the zone's DNSSEC status is Unsigned. Deleting a private key is only meaningful on a signed zone; an unsigned zone has no key store to mutate.

Source

Thrown at DnsServerCore/Dns/Zones/PrimaryZone.cs:1091

        }

        public DnssecPrivateKey UpdatePrivateKey(ushort keyTag, ushort rolloverDays)
        {
            lock (_dnssecPrivateKeys)
            {
                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out DnssecPrivateKey privateKey))
                    throw new DnsServerException("Cannot update private key: no such private key was found.");

                privateKey.RolloverDays = rolloverDays;

                return privateKey;
            }
        }

        public void DeletePrivateKey(ushort keyTag)
        {
            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)
                throw new DnsServerException("The zone must be signed.");

            lock (_dnssecPrivateKeys)
            {
                if (!_dnssecPrivateKeys.TryGetValue(keyTag, out DnssecPrivateKey privateKey))
                    throw new DnsServerException("Cannot delete private key: no such private key was found.");

                if (privateKey.State != DnssecPrivateKeyState.Generated)
                    throw new DnsServerException("Cannot delete private key: only keys with Generated state can be deleted.");

                _dnssecPrivateKeys.Remove(keyTag);
            }
        }

        public void PublishAllGeneratedKeys()
        {
            if (_dnssecStatus == AuthZoneDnssecStatus.Unsigned)
                throw new DnsServerException("The zone must be signed.");

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Guard the call with a DnssecStatus != Unsigned check.
2. If the zone was unsigned, the keys are already gone; nothing to delete.
3. Restrict cleanup scripts to zones where DnssecStatus is SignedWithNSEC or SignedWithNSEC3.

Example fix

// before
zone.DeletePrivateKey(keyTag);

// after
if (zone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)
    zone.DeletePrivateKey(keyTag);

// Only delete keys on a signed zone
if (zone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)
    zone.DeletePrivateKey(keyTag);

static bool CanDeletePrivateKey(ApexZone zone) =>
    zone.DnssecStatus != AuthZoneDnssecStatus.Unsigned;

try
{
    zone.DeletePrivateKey(keyTag);
}
catch (DnsServerException ex) when (ex.Message == "The zone must be signed.")
{
    // nothing to delete on an unsigned zone
}

When it happens

Trigger: Calling DeletePrivateKey(keyTag) on a zone whose DnssecStatus is Unsigned.

Common situations: A cleanup routine that runs against all zones regardless of signing state, hitting a zone that was never signed or was unsigned via UnsignZone.

Related errors

• The primary zone must be signed.
• Cannot delete private key: only keys with Generated state ca
• Cannot convert to NSEC3: the zone must be signed with NSEC f
• Cannot update NSEC3 parameters: the zone must be signed with
• Failed to add {(privateKey.KeyType == DnssecPrivateKeyType.K

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/dc1cc08614abe6cf. Report an issue: GitHub.