TechnitiumSoftware/DnsServer · error · ArgumentException

The Zone Transfer option is invalid for {0} zones: {1}

Error message

The Zone Transfer option is invalid for {0} zones: {1}

What it means

Thrown by the ForwarderZone.ZoneTransfer property setter when value is AuthZoneTransfer.AllowOnlyZoneNameServers (2) or AllowZoneNameServersAndUseSpecifiedNetworkACL (4). Both modes gate AXFR/IXFR to the zone's authoritative name servers, which a Conditional Forwarder does not have (it is non-authoritative, holding a dummy SOA + FWD). Valid transfer options for a forwarder zone are Deny(0), Allow(1), and UseSpecifiedNetworkACL(3). ArgumentException names 'ZoneTransfer'.

Source

Thrown at DnsServerCore/Dns/Zones/ForwarderZone.cs:325

                    case AuthZoneQueryAccess.AllowOnlyZoneNameServers:
                    case AuthZoneQueryAccess.AllowZoneNameServersAndUseSpecifiedNetworkACL:
                        throw new ArgumentException("The Query Access option is invalid for " + GetZoneTypeName() + " zones: " + value.ToString(), nameof(QueryAccess));
                }

                base.QueryAccess = value;
            }
        }

        public override AuthZoneTransfer ZoneTransfer
        {
            get { return base.ZoneTransfer; }
            set
            {
                switch (value)
                {
                    case AuthZoneTransfer.AllowOnlyZoneNameServers:
                    case AuthZoneTransfer.AllowZoneNameServersAndUseSpecifiedNetworkACL:
                        throw new ArgumentException("The Zone Transfer option is invalid for " + GetZoneTypeName() + " zones: " + value.ToString(), nameof(ZoneTransfer));
                }

                base.ZoneTransfer = value;
            }
        }

        public override AuthZoneNotify Notify
        {
            get { return base.Notify; }
            set
            {
                switch (value)
                {
                    case AuthZoneNotify.ZoneNameServers:
                    case AuthZoneNotify.BothZoneAndSpecifiedNameServers:
                        throw new ArgumentException("The Notify option is invalid for " + GetZoneTypeName() + " zones: " + value.ToString(), nameof(Notify));

                    case AuthZoneNotify.SeparateNameServersForCatalogAndMemberZones:

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Use Deny, Allow, or UseSpecifiedNetworkACL for a ForwarderZone's ZoneTransfer.
2. Restrict the enum choices presented for forwarder zones in your provisioning/config layer.
3. If NS-restricted transfers are required, the zone should be a primary or secondary zone, not a conditional forwarder.

Example fix

// before
zone.ZoneTransfer = AuthZoneTransfer.AllowOnlyZoneNameServers;

// after
zone.ZoneTransfer = AuthZoneTransfer.UseSpecifiedNetworkACL;

var valid = new[] { AuthZoneTransfer.Deny, AuthZoneTransfer.Allow, AuthZoneTransfer.UseSpecifiedNetworkACL };
if (!valid.Contains(value)) throw new ArgumentException($"ZoneTransfer {value} not valid for forwarder zone.");
zone.ZoneTransfer = value;

static bool IsValidForwarderZoneTransfer(AuthZoneTransfer v) => v == AuthZoneTransfer.Deny || v == AuthZoneTransfer.Allow || v == AuthZoneTransfer.UseSpecifiedNetworkACL;

try { zone.ZoneTransfer = value; }
catch (ArgumentException) { zone.ZoneTransfer = AuthZoneTransfer.UseSpecifiedNetworkACL; }

When it happens

Trigger: Assigning zone.ZoneTransfer = AuthZoneTransfer.AllowOnlyZoneNameServers (or ...AndUseSpecifiedNetworkACL) on a ForwarderZone, e.g. via zone settings API or a template applied across all zones.

Common situations: Applying a uniform 'zone transfer = name servers only' security template to every zone including forwarders; migrating settings from a primary zone; automated provisioning that does not branch on zone type.

Related errors

• The Query Access option is invalid for {0} zones: {1}
• The Dynamic Updates option is invalid for {0} zones: {1}
• Networks cannot have more than 255 entries.
• The Notify option is invalid for {0} zones: {1}
• Unix Domain Sockets (UDS) are supported only on Linux, Windo

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/8ecbd158447ea007. Report an issue: GitHub.