TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

Zone Signing Key (ZSK) automatic rollover days valid range i

Error message

Zone Signing Key (ZSK) automatic rollover days valid range is 0-365.

What it means

Thrown by the RolloverDays property setter on a Zone Signing Key (ZSK) when the value exceeds 365 days. The setter (DnssecPrivateKey.cs:438) only validates the upper bound for ZSKs and only after confirming _keyType is ZoneSigningKey, so this guards the auto-rollover scheduler interval. A value of 0 disables automatic rollover; anything from 1 to 365 schedules it.

Source

Thrown at DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs:438

        public DateTime StateTransitionBy
        { get { return _stateTransitionBy; } }

        public DateTime StateTransitionByWithDelays
        { get { return _stateTransitionBy.AddMilliseconds(PrimaryZone.DNSSEC_TIMER_PERIODIC_INTERVAL); } }

        public bool IsRetiring
        { get { return _isRetiring; } }

        public ushort RolloverDays
        {
            get { return _rolloverDays; }
            set
            {
                if (_keyType == DnssecPrivateKeyType.ZoneSigningKey)
                {
                    if (value > 365)
                        throw new ArgumentOutOfRangeException(nameof(RolloverDays), "Zone Signing Key (ZSK) automatic rollover days valid range is 0-365.");

                    switch (_state)
                    {
                        case DnssecPrivateKeyState.Generated:
                        case DnssecPrivateKeyState.Published:
                        case DnssecPrivateKeyState.Ready:
                        case DnssecPrivateKeyState.Active:
                            if (_isRetiring)
                                throw new InvalidOperationException("Zone Signing Key (ZSK) automatic rollover cannot be set since it is set to retire.");

                            break;

                        default:
                            throw new InvalidOperationException("Zone Signing Key (ZSK) automatic rollover cannot be set due to invalid key state.");
                    }
                }
                else
                {

View on GitHub (pinned to d0484b6c1e)

Solutions

  1. Clamp the configured value to the supported 0-365 range before assigning: value 0 disables auto-rollover, 365 is the maximum.
  2. If you need longer rollover cycles, set RolloverDays to 0 and schedule manual key rollover via the DNSSEC API.
  3. Validate the input in your UI/config layer with an ArgumentOutOfRangeException-style range check so the user is told the bound before it reaches the setter.

Example fix

// before
key.RolloverDays = requestedDays; // requestedDays == 730

// after
const int MAX_ZSK_ROLLOVER_DAYS = 365;
int days = Math.Clamp(requestedDays, 0, MAX_ZSK_ROLLOVER_DAYS);
key.RolloverDays = (ushort)days;
Defensive patterns

Strategy: validation

Validate before calling

const int MAX_ZSK_ROLLOVER_DAYS = 365;
if (key.KeyType == DnssecPrivateKeyType.ZoneSigningKey && requestedDays is > 365)
    throw new ArgumentOutOfRangeException(nameof(requestedDays), "ZSK rollover days must be 0-365.");
key.RolloverDays = (ushort)Math.Clamp(requestedDays, 0, MAX_ZSK_ROLLOVER_DAYS);

Try / catch

try { key.RolloverDays = (ushort)days; }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(key.RolloverDays))
{ /* inform user of 0-365 bound */ }

Prevention

When it happens

Trigger: Assigning DnssecPrivateKey.RolloverDays to a value greater than 365 on a key whose _keyType == DnssecPrivateKeyType.ZoneSigningKey. Reachable from the DNSSEC settings UI or any API/serialzation path that restores RolloverDays.

Common situations: Operator types a multi-year rollover period into the web console; a config import from another DNS server supplies a value in months that is passed as days; an automated script sets RolloverDays from an unvalidated config field.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/95b8a81b8142dc6c. Report an issue: GitHub.