TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

TSIG keys cannot have more than 255 entries.

Error message

TSIG keys cannot have more than 255 entries.

What it means

Thrown by the TsigKeys property setter when the supplied dictionary contains more than 255 entries. The 255 limit exists because the count is serialized into a single byte on disk/in the cluster protocol, so exceeding it would overflow the wire format. TSIG (RFC 2845) keys authenticate zone transfers and dynamic updates.

Source

Thrown at DnsServerCore/Dns/DnsServer.cs:7857

                    _dnsOverHttpRealIpHeader = "X-Real-IP";
                else if (value.Length > 255)
                    throw new ArgumentException("DNS-over-HTTP Real IP header name cannot exceed 255 characters.", nameof(DnsOverHttpRealIpHeader));
                else if (value.Contains(' '))
                    throw new ArgumentException("DNS-over-HTTP Real IP header name cannot contain invalid characters.", nameof(DnsOverHttpRealIpHeader));
                else
                    _dnsOverHttpRealIpHeader = value;
            }
        }

        public IReadOnlyDictionary<string, TsigKey> TsigKeys
        {
            get { return _tsigKeys; }
            set
            {
                if ((value is null) || (value.Count == 0))
                    _tsigKeys = null;
                else if (value.Count > byte.MaxValue)
                    throw new ArgumentOutOfRangeException(nameof(TsigKeys), "TSIG keys cannot have more than 255 entries.");
                else
                    _tsigKeys = value;
            }
        }

        public DnsServerRecursion Recursion
        {
            get { return _recursion; }
            set
            {
                if (_recursion != value)
                {
                    if ((_recursion == DnsServerRecursion.Deny) || (value == DnsServerRecursion.Deny))
                    {
                        _recursion = value;
                        ResetPrefetchTimers();
                    }
                    else

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Reduce the key set to 255 or fewer entries by consolidating shared keys across zones.
2. Audit for stale/duplicate keys and remove ones no longer referenced by any zone or peer.
3. If you genuinely need more, re-architect so only the active subset is loaded at once.

Example fix

// before
server.TsigKeys = allKeys; // allKeys.Count == 300

// after
server.TsigKeys = allKeys.Take(255).ToDictionary(k => k.Key, k => k.Value);

const int MaxTsigKeys = 255;
if (keys.Count > MaxTsigKeys)
    throw new InvalidOperationException($"TSIG key set has {keys.Count} entries; max is {MaxTsigKeys}.");
server.TsigKeys = keys;

static bool WithinTsigLimit(IReadOnlyDictionary<string, TsigKey> keys) =>
    keys is null || keys.Count <= 255;

try { server.TsigKeys = keys; }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(server.TsigKeys))
{
    logger.Error("Too many TSIG keys supplied; loading first 255 only.");
    server.TsigKeys = keys.Take(255).ToDictionary(k => k.Key, k => k.Value);
}

When it happens

Trigger: Assigning an IReadOnlyDictionary<string, TsigKey> with Count > byte.MaxValue (255) to DnsServer.TsigKeys.

Common situations: Bulk-importing a large keyring from another DNS server; auto-generating per-zone TSIG keys at scale; migrating a multi-tenant setup that provisions one key per tenant.

Related errors

• Valid range is from 1 to 10.
• Valid range is from 1 to 4.
• Valid range is from 10 to 30.
• Serve stale max wait time valid range is 0 to 1800 milliseco
• DNS-over-HTTP Real IP header name cannot exceed 255 characte

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/f741fb9dce977a3b. Report an issue: GitHub.