{"record":{"id":"5e1124560ada1481","repo":"TechnitiumSoftware/DnsServer","slug":"zone-transfer-tsig-key-names-cannot-have-more-than","errorCode":null,"errorMessage":"Zone transfer TSIG key names cannot have more than 255 entries.","messagePattern":"Zone transfer TSIG key names cannot have more than 255 entries\\.","errorType":"validation","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/ApexZone.cs","lineNumber":1342,"sourceCode":"            {\n                if ((value is null) || (value.Count == 0))\n                    _zoneTransferNetworkACL = null;\n                else if (value.Count > byte.MaxValue)\n                    throw new ArgumentOutOfRangeException(nameof(ZoneTransferNetworkACL), \"Network ACL cannot have more than 255 entries.\");\n                else\n                    _zoneTransferNetworkACL = value;\n            }\n        }\n\n        public IReadOnlySet<string> ZoneTransferTsigKeyNames\n        {\n            get { return _zoneTransferTsigKeyNames; }\n            set\n            {\n                if ((value is null) || (value.Count == 0))\n                    _zoneTransferTsigKeyNames = null;\n                else if (value.Count > byte.MaxValue)\n                    throw new ArgumentOutOfRangeException(nameof(ZoneTransferTsigKeyNames), \"Zone transfer TSIG key names cannot have more than 255 entries.\");\n                else\n                    _zoneTransferTsigKeyNames = value;\n\n                //update catalog zone property\n                if (this is CatalogZone thisCatalogZone)\n                {\n                    //update global custom property\n                    thisCatalogZone.SetZoneTransferTsigKeyNamesProperty(_zoneTransferTsigKeyNames);\n                }\n                else if (!Disabled && ((this is PrimaryZone) || (this is SecondaryZone && this is not SecondaryForwarderZone)))\n                {\n                    CatalogZone catalogZone = CatalogZone;\n                    if (catalogZone is not null)\n                    {\n                        if (_overrideCatalogZoneTransfer)\n                            catalogZone.SetZoneTransferTsigKeyNamesProperty(_zoneTransferTsigKeyNames, _name); //update member zone custom property\n                        else\n                            catalogZone.SetZoneTransferTsigKeyNamesProperty(null, _name); //remove member zone custom property","sourceCodeStart":1324,"sourceCodeEnd":1360,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/ApexZone.cs#L1324-L1360","documentation":"Thrown by the ZoneTransferTsigKeyNames setter when the supplied set of TSIG key names has more than 255 entries. TSIG key names are persisted with a single-byte count, so the cap is 255; null/empty clears the set. Setting also propagates to the catalog zone / updates catalog properties for catalog zones and primary/secondary zones.","triggerScenarios":"Assigning > 255 TSIG key names for zone-transfer authentication; bulk-loading a large key roster.","commonSituations":"Many per-zone TSIG keys accumulated over time; importing keys from a large multi-tenant deployment.","solutions":["Limit ZoneTransferTsigKeyNames to <= 255 entries; consolidate zones to share TSIG keys.","Use network ACLs (ZoneTransferNetworkACL) alongside a smaller TSIG set to cover more peers.","Remove obsolete/unused TSIG key names before assigning."],"exampleFix":"// before\nzone.ZoneTransferTsigKeyNames = keyNames; // Count > 255 -> throws\n// after\nzone.ZoneTransferTsigKeyNames = keyNames.Take(255).ToHashSet();","handlingStrategy":"validation","validationCode":"if (keys != null && keys.Count > byte.MaxValue)\n    throw new InvalidOperationException($\"ZoneTransferTsigKeyNames capped at 255 (got {keys.Count}).\");\nzone.ZoneTransferTsigKeyNames = keys;","typeGuard":"static bool IsValidTsigKeyCount(IReadOnlySet<string> keys) => keys is null || keys.Count <= byte.MaxValue;","tryCatchPattern":"try { zone.ZoneTransferTsigKeyNames = keys; }\ncatch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(zone.ZoneTransferTsigKeyNames))\n{ zone.ZoneTransferTsigKeyNames = keys.Take(byte.MaxValue).ToHashSet(); }","preventionTips":["Share TSIG keys across zones to reduce the per-zone count.","Remove obsolete TSIG key names before assigning.","Combine TSIG auth with network ACLs to cover more peers.","Enforce the 255 cap at the config UI."],"tags":["dns","tsig","zone-transfer","validation","security"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}