{"record":{"id":"4e86ccddb4f53354","repo":"TechnitiumSoftware/DnsServer","slug":"the-record-type-is-not-supported-by-dnssec-signed-4e86cc","errorCode":null,"errorMessage":"The record type is not supported by DNSSEC signed primary zones.","messagePattern":"The record type is not supported by DNSSEC signed primary zones\\.","errorType":"exception","errorClass":"DnsServerException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/PrimaryZone.cs","lineNumber":2516,"sourceCode":"\n        #endregion\n\n        #region public\n\n        public override string GetZoneTypeName()\n        {\n            return \"Primary\";\n        }\n\n        public override void SetRecords(DnsResourceRecordType type, IReadOnlyList<DnsResourceRecord> records)\n        {\n            if (_dnssecStatus != AuthZoneDnssecStatus.Unsigned)\n            {\n                switch (type)\n                {\n                    case DnsResourceRecordType.ANAME:\n                    case DnsResourceRecordType.APP:\n                        throw new DnsServerException(\"The record type is not supported by DNSSEC signed primary zones.\");\n\n                    default:\n                        foreach (DnsResourceRecord record in records)\n                        {\n                            if (record.GetAuthGenericRecordInfo().Disabled)\n                                throw new DnsServerException(\"Cannot set records: disabling records in a signed zones is not supported.\");\n                        }\n\n                        break;\n                }\n            }\n\n            switch (type)\n            {\n                case DnsResourceRecordType.CNAME:\n                case DnsResourceRecordType.DS:\n                    throw new InvalidOperationException(\"Cannot set \" + type.ToString() + \" record at zone apex.\");\n","sourceCodeStart":2498,"sourceCodeEnd":2534,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/PrimaryZone.cs#L2498-L2534","documentation":"Thrown by PrimaryZone.SetRecords() when the zone is DNSSEC-signed (_dnssecStatus != Unsigned) and the requested record type is ANAME or APP. ANAME and APP are synthesized/algorithmic records maintained by the server, and signing their changing values into DNSSEC (RRSIG/NSEC) is unsupported, so a signed primary zone refuses to store them directly.","triggerScenarios":"Calling SetRecords(DnsResourceRecordType.ANAME, ...) or SetRecords(DnsResourceRecordType.APP, ...) on a primary zone whose _dnssecStatus is SignedWithNSEC or SignedWithNSEC3.","commonSituations":"Migrating a zone that previously used ANAME/APP records into DNSSEC signing without removing those records first; automation that blindly copies a full zone template including ANAME entries onto a signed zone.","solutions":["Do not set ANAME or APP records on a signed primary zone; use standard A/AAAA records instead.","If ANAME/APP functionality is required, keep the zone unsigned.","Strip ANAME/APP records from the input set before calling SetRecords on a signed zone."],"exampleFix":"// before\nzone.SetRecords(DnsResourceRecordType.ANAME, anameRecords); // signed zone rejects\n\n// after\nzone.SetRecords(DnsResourceRecordType.A, resolvedARecords); // use concrete records on signed zone","handlingStrategy":"validation","validationCode":"// Reject ANAME/APP before SetRecords on a signed zone.\nif (IsZoneSigned(zone) && (type == DnsResourceRecordType.ANAME || type == DnsResourceRecordType.APP))\n    throw new ArgumentException(\"ANAME/APP not supported on signed zones; use A/AAAA.\");\n\nzone.SetRecords(type, records);","typeGuard":"static bool IsTypeAllowedOnSignedZone(DnsResourceRecordType t) =>\n    t != DnsResourceRecordType.ANAME && t != DnsResourceRecordType.APP;","tryCatchPattern":"try { zone.SetRecords(type, records); }\ncatch (DnsServerException ex) when (ex.Message.Contains(\"not supported by DNSSEC signed primary zones\"))\n{ Log.Error($\"Unsupported type on signed zone: {type}\"); }","preventionTips":["Convert ANAME/APP to concrete A/AAAA before signing a zone.","Classify record types as user-managed vs algorithmic in import tooling.","Gate signed-zone writes through an allow-list of record types."],"tags":["dns","dnssec","record","aname","app","zone-management","validation"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}