TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

Zone transfer TSIG key names cannot have more than 255 entri

Error message

Zone transfer TSIG key names cannot have more than 255 entries.

What it means

Thrown by the ZoneTransferTsigKeyNames setter when the supplied set of TSIG key names has more than 255 entries. TSIG key names are persisted with a single-byte count, so the cap is 255; null/empty clears the set. Setting also propagates to the catalog zone / updates catalog properties for catalog zones and primary/secondary zones.

Source

Thrown at DnsServerCore/Dns/Zones/ApexZone.cs:1342

            {
                if ((value is null) || (value.Count == 0))
                    _zoneTransferNetworkACL = null;
                else if (value.Count > byte.MaxValue)
                    throw new ArgumentOutOfRangeException(nameof(ZoneTransferNetworkACL), "Network ACL cannot have more than 255 entries.");
                else
                    _zoneTransferNetworkACL = value;
            }
        }

        public IReadOnlySet<string> ZoneTransferTsigKeyNames
        {
            get { return _zoneTransferTsigKeyNames; }
            set
            {
                if ((value is null) || (value.Count == 0))
                    _zoneTransferTsigKeyNames = null;
                else if (value.Count > byte.MaxValue)
                    throw new ArgumentOutOfRangeException(nameof(ZoneTransferTsigKeyNames), "Zone transfer TSIG key names cannot have more than 255 entries.");
                else
                    _zoneTransferTsigKeyNames = value;

                //update catalog zone property
                if (this is CatalogZone thisCatalogZone)
                {
                    //update global custom property
                    thisCatalogZone.SetZoneTransferTsigKeyNamesProperty(_zoneTransferTsigKeyNames);
                }
                else if (!Disabled && ((this is PrimaryZone) || (this is SecondaryZone && this is not SecondaryForwarderZone)))
                {
                    CatalogZone catalogZone = CatalogZone;
                    if (catalogZone is not null)
                    {
                        if (_overrideCatalogZoneTransfer)
                            catalogZone.SetZoneTransferTsigKeyNamesProperty(_zoneTransferTsigKeyNames, _name); //update member zone custom property
                        else
                            catalogZone.SetZoneTransferTsigKeyNamesProperty(null, _name); //remove member zone custom property

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Limit ZoneTransferTsigKeyNames to <= 255 entries; consolidate zones to share TSIG keys.
2. Use network ACLs (ZoneTransferNetworkACL) alongside a smaller TSIG set to cover more peers.
3. Remove obsolete/unused TSIG key names before assigning.

Example fix

// before
zone.ZoneTransferTsigKeyNames = keyNames; // Count > 255 -> throws
// after
zone.ZoneTransferTsigKeyNames = keyNames.Take(255).ToHashSet();

if (keys != null && keys.Count > byte.MaxValue)
    throw new InvalidOperationException($"ZoneTransferTsigKeyNames capped at 255 (got {keys.Count}).");
zone.ZoneTransferTsigKeyNames = keys;

static bool IsValidTsigKeyCount(IReadOnlySet<string> keys) => keys is null || keys.Count <= byte.MaxValue;

try { zone.ZoneTransferTsigKeyNames = keys; }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(zone.ZoneTransferTsigKeyNames))
{ zone.ZoneTransferTsigKeyNames = keys.Take(byte.MaxValue).ToHashSet(); }

When it happens

Trigger: Assigning > 255 TSIG key names for zone-transfer authentication; bulk-loading a large key roster.

Common situations: Many per-zone TSIG keys accumulated over time; importing keys from a large multi-tenant deployment.

Related errors

• The application name contains an invalid character: {invalid
• TSIG keys cannot have more than 255 entries.
• Name server addresses cannot have more than 255 entries.
• Secondary Catalog name server addresses cannot have more tha
• Cluster node URL must use HTTPS scheme.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/5e1124560ada1481. Report an issue: GitHub.