{"record":{"id":"0230a37b29e871e3","repo":"TechnitiumSoftware/DnsServer","slug":"cannot-update-record-disabling-records-in-a-signe-0230a3","errorCode":null,"errorMessage":"Cannot update record: disabling records in a signed zones is not supported.","messagePattern":"Cannot update record: disabling records in a signed zones is not supported\\.","errorType":"exception","errorClass":"DnsServerException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/PrimaryZone.cs","lineNumber":2759,"sourceCode":"        {\n            switch (oldRecord.Type)\n            {\n                case DnsResourceRecordType.SOA:\n                    throw new InvalidOperationException(\"Cannot update record: use SetRecords() for \" + oldRecord.Type.ToString() + \" record\");\n\n                case DnsResourceRecordType.DNSKEY:\n                case DnsResourceRecordType.RRSIG:\n                case DnsResourceRecordType.NSEC:\n                case DnsResourceRecordType.NSEC3PARAM:\n                case DnsResourceRecordType.NSEC3:\n                    throw new InvalidOperationException(\"Cannot update DNSSEC records.\");\n\n                default:\n                    if (oldRecord.Type != newRecord.Type)\n                        throw new InvalidOperationException(\"Old and new record types do not match.\");\n\n                    if ((_dnssecStatus != AuthZoneDnssecStatus.Unsigned) && newRecord.GetAuthGenericRecordInfo().Disabled)\n                        throw new DnsServerException(\"Cannot update record: disabling records in a signed zones is not supported.\");\n\n                    if (newRecord.OriginalTtlValue > GetZoneSoaExpire())\n                        throw new DnsServerException(\"Cannot update record: TTL cannot be greater than SOA EXPIRE.\");\n\n                    if (!TryDeleteRecord(oldRecord.Type, oldRecord.RDATA, out DnsResourceRecord deletedRecord))\n                        throw new DnsServerException(\"Cannot update record: the record does not exists to be updated.\");\n\n                    AddRecord(newRecord, out IReadOnlyList<DnsResourceRecord> addedRecords, out IReadOnlyList<DnsResourceRecord> deletedRecords);\n\n                    List<DnsResourceRecord> allDeletedRecords = new List<DnsResourceRecord>(deletedRecords.Count + 1);\n                    allDeletedRecords.Add(deletedRecord);\n                    allDeletedRecords.AddRange(deletedRecords);\n\n                    CommitAndIncrementSerial(allDeletedRecords, addedRecords);\n\n                    if (_dnssecStatus != AuthZoneDnssecStatus.Unsigned)\n                        UpdateDnssecRecordsFor(this, oldRecord.Type);\n","sourceCodeStart":2741,"sourceCodeEnd":2777,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/PrimaryZone.cs#L2741-L2777","documentation":"Thrown by PrimaryZone.UpdateRecord (default case) when the zone is DNSSEC-signed (_dnssecStatus != Unsigned) and the new record is being disabled (newRecord.GetAuthGenericRecordInfo().Disabled == true). Disabling a record in a signed zone would invalidate the chain of trust (RRSIG/NSEC), so the library rejects it as a DnsServerException.","triggerScenarios":"Calling zone.UpdateRecord on a signed PrimaryZone with a newRecord whose Disabled flag is set; toggling the disabled bit on a record in a zone with active DNSSEC.","commonSituations":"Temporarily disabling a record for maintenance; importing records that carry the DISABLED pseudo-RR flag; pausing a service behind a record in a signed zone.","solutions":["Remove the DISABLED flag on newRecord before updating in a signed zone.","If disabling is genuinely needed, unsign the zone first, then re-sign after.","Delete the record instead of disabling it (the signing engine regenerates NSEC)."],"exampleFix":"// before\nvar info = newRecord.GetAuthGenericRecordInfo();\ninfo.Disabled = true;\nzone.UpdateRecord(oldRecord, newRecord);\n\n// after\nvar info = newRecord.GetAuthGenericRecordInfo();\ninfo.Disabled = false; // signed zone: do not disable\nzone.UpdateRecord(oldRecord, newRecord);","handlingStrategy":"validation","validationCode":"if (zone.GetDnssecStatus() != AuthZoneDnssecStatus.Unsigned &&\n    newRecord.GetAuthGenericRecordInfo().Disabled)\n    newRecord.GetAuthGenericRecordInfo().Disabled = false;\nzone.UpdateRecord(oldRecord, newRecord);","typeGuard":"static bool CanDisableInZone(AuthZoneDnssecStatus status, DnsResourceRecord r) =>\n    status == AuthZoneDnssecStatus.Unsigned || !r.GetAuthGenericRecordInfo().Disabled;","tryCatchPattern":"null","preventionTips":["Check the zone's signed status before honoring a DISABLED flag.","Prefer delete over disable in signed zones so NSEC is regenerated."],"tags":["dns","primary-zone","dnssec","disabled-record","validation"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}