{"record":{"id":"3c4ab06a24bc5087","repo":"TechnitiumSoftware/DnsServer","slug":"cannot-set-records-disabling-records-in-a-signed-3c4ab0","errorCode":null,"errorMessage":"Cannot set records: disabling records in a signed zones is not supported.","messagePattern":"Cannot set records: disabling records in a signed zones is not supported\\.","errorType":"exception","errorClass":"DnsServerException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/PrimaryZone.cs","lineNumber":2522,"sourceCode":"        {\n            return \"Primary\";\n        }\n\n        public override void SetRecords(DnsResourceRecordType type, IReadOnlyList<DnsResourceRecord> records)\n        {\n            if (_dnssecStatus != AuthZoneDnssecStatus.Unsigned)\n            {\n                switch (type)\n                {\n                    case DnsResourceRecordType.ANAME:\n                    case DnsResourceRecordType.APP:\n                        throw new DnsServerException(\"The record type is not supported by DNSSEC signed primary zones.\");\n\n                    default:\n                        foreach (DnsResourceRecord record in records)\n                        {\n                            if (record.GetAuthGenericRecordInfo().Disabled)\n                                throw new DnsServerException(\"Cannot set records: disabling records in a signed zones is not supported.\");\n                        }\n\n                        break;\n                }\n            }\n\n            switch (type)\n            {\n                case DnsResourceRecordType.CNAME:\n                case DnsResourceRecordType.DS:\n                    throw new InvalidOperationException(\"Cannot set \" + type.ToString() + \" record at zone apex.\");\n\n                case DnsResourceRecordType.SOA:\n                    if ((records.Count != 1) || !records[0].Name.Equals(_name, StringComparison.OrdinalIgnoreCase))\n                        throw new InvalidOperationException(\"Invalid SOA record.\");\n\n                    DnsResourceRecord newSoaRecord = records[0];\n                    DnsSOARecordData newSoa = newSoaRecord.RDATA as DnsSOARecordData;","sourceCodeStart":2504,"sourceCodeEnd":2540,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/PrimaryZone.cs#L2504-L2540","documentation":"Thrown by PrimaryZone.SetRecords() on a signed zone when any record in the input list has its Disabled flag set (record.GetAuthGenericRecordInfo().Disabled == true). Signed zones must sign every record in an RRset, and a disabled record would break the RRset/NSEC chain consistency, so disabling records is disallowed in signed zones.","triggerScenarios":"Calling SetRecords on a signed primary zone with one or more records whose AuthGenericRecordInfo.Disabled is true.","commonSituations":"Importing a zone export that contains paused/disabled records into a signed zone; a UI that lets operators disable individual records re-saving the zone after signing.","solutions":["Clear the Disabled flag on every record before passing them to SetRecords on a signed zone, or remove the record instead of disabling it.","If you need to temporarily withdraw a record from a signed zone, delete it (the zone will re-sign) rather than disabling it.","Filter or normalize the record list to ensure no Disabled entries reach SetRecords for signed zones."],"exampleFix":"// before\nzone.SetRecords(type, records); // throws if any record.Disabled\n\n// after\nvar enabled = records.Where(r => !r.GetAuthGenericRecordInfo().Disabled).ToList();\nzone.SetRecords(type, enabled);","handlingStrategy":"validation","validationCode":"// Drop or enable disabled records before SetRecords on a signed zone.\nif (IsZoneSigned(zone))\n    records = records.Where(r => !r.GetAuthGenericRecordInfo().Disabled).ToList();\n\nzone.SetRecords(type, records);","typeGuard":"static bool HasNoDisabledRecords(IReadOnlyList<DnsResourceRecord> rs) =>\n    rs.All(r => !r.GetAuthGenericRecordInfo().Disabled);","tryCatchPattern":"try { zone.SetRecords(type, records); }\ncatch (DnsServerException ex) when (ex.Message.Contains(\"disabling records in a signed zones\"))\n{ Log.Error(\"Remove Disabled records before writing to a signed zone.\"); }","preventionTips":["Normalize imported zones to strip Disabled flags before signing.","Delete rather than disable records on signed zones.","Validate the Disabled flag in pre-commit checks."],"tags":["dns","dnssec","record","disabled","zone-management","validation"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}