{"record":{"id":"18c9e514c3060e13","repo":"TechnitiumSoftware/DnsServer","slug":"cannot-add-record-disabling-records-in-a-signed-z-18c9e5","errorCode":null,"errorMessage":"Cannot add record: disabling records in a signed zones is not supported.","messagePattern":"Cannot add record: disabling records in a signed zones is not supported\\.","errorType":"exception","errorClass":"DnsServerException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/PrimaryZone.cs","lineNumber":2632,"sourceCode":"\n                    TriggerNotify();\n                    break;\n            }\n        }\n\n        public override bool AddRecord(DnsResourceRecord record)\n        {\n            if (_dnssecStatus != AuthZoneDnssecStatus.Unsigned)\n            {\n                switch (record.Type)\n                {\n                    case DnsResourceRecordType.ANAME:\n                    case DnsResourceRecordType.APP:\n                        throw new DnsServerException(\"The record type is not supported by DNSSEC signed primary zones.\");\n\n                    default:\n                        if (record.GetAuthGenericRecordInfo().Disabled)\n                            throw new DnsServerException(\"Cannot add record: disabling records in a signed zones is not supported.\");\n\n                        break;\n                }\n            }\n\n            switch (record.Type)\n            {\n                case DnsResourceRecordType.APP:\n                    throw new InvalidOperationException(\"Cannot add record: use SetRecords() for \" + record.Type.ToString() + \" record\");\n\n                case DnsResourceRecordType.DS:\n                    throw new InvalidOperationException(\"Cannot set DS record at zone apex.\");\n\n                case DnsResourceRecordType.DNSKEY:\n                case DnsResourceRecordType.RRSIG:\n                case DnsResourceRecordType.NSEC:\n                case DnsResourceRecordType.NSEC3PARAM:\n                case DnsResourceRecordType.NSEC3:","sourceCodeStart":2614,"sourceCodeEnd":2650,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/PrimaryZone.cs#L2614-L2650","documentation":"Thrown by PrimaryZone.AddRecord() on a signed zone when the record being added has its Disabled flag set (record.GetAuthGenericRecordInfo().Disabled == true). A signed zone must sign every record in an RRset; a disabled record would break RRset/NSEC consistency, so disabled records cannot be added to signed zones.","triggerScenarios":"Calling AddRecord on a signed primary zone with a record whose AuthGenericRecordInfo.Disabled is true.","commonSituations":"Importing records that were paused/disabled in another server into a signed zone; a UI re-adding a previously disabled record after signing.","solutions":["Clear the Disabled flag on the record before adding it to a signed zone, or do not add it.","To withdraw a record from a signed zone, omit it; the zone re-signs without it.","Validate !Disabled before calling AddRecord on signed zones."],"exampleFix":"// before\nzone.AddRecord(record); // throws if record.Disabled\n\n// after\nif (!record.GetAuthGenericRecordInfo().Disabled)\n    zone.AddRecord(record);","handlingStrategy":"validation","validationCode":"if (IsZoneSigned(zone) && record.GetAuthGenericRecordInfo().Disabled)\n    throw new ArgumentException(\"Disabled records cannot be added to signed zones.\");\n\nzone.AddRecord(record);","typeGuard":"static bool IsAddableToSignedZone(DnsResourceRecord r) =>\n    !r.GetAuthGenericRecordInfo().Disabled;","tryCatchPattern":"try { zone.AddRecord(record); }\ncatch (DnsServerException ex) when (ex.Message.Contains(\"disabling records in a signed zones\"))\n{ Log.Error(\"Clear the Disabled flag before adding to a signed zone.\"); }","preventionTips":["Clear Disabled flags during import into signed zones.","Delete rather than disable records on signed zones.","Pre-validate the Disabled flag in record builders."],"tags":["dns","dnssec","record","disabled","zone-management","validation"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}