{"record":{"id":"5ed91a8d4743650e","repo":"TechnitiumSoftware/DnsServer","slug":"the-dynamic-updates-option-is-invalid-for-secondar","errorCode":null,"errorMessage":"The Dynamic Updates option is invalid for Secondary Conditional Forwarder zones: {}","messagePattern":"The Dynamic Updates option is invalid for Secondary Conditional Forwarder zones: (.+?)","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/SecondaryForwarderZone.cs","lineNumber":139,"sourceCode":"            set { throw new InvalidOperationException(); }\n        }\n\n        public override AuthZoneNotify Notify\n        {\n            get { return base.Notify; }\n            set { throw new InvalidOperationException(); }\n        }\n\n        public override AuthZoneUpdate Update\n        {\n            get { return base.Update; }\n            set\n            {\n                switch (value)\n                {\n                    case AuthZoneUpdate.AllowOnlyZoneNameServers:\n                    case AuthZoneUpdate.AllowZoneNameServersAndUseSpecifiedNetworkACL:\n                        throw new ArgumentException(\"The Dynamic Updates option is invalid for Secondary Conditional Forwarder zones: \" + value.ToString(), nameof(Update));\n                }\n\n                base.Update = value;\n            }\n        }\n\n        public override IReadOnlyList<NameServerAddress> PrimaryNameServerAddresses\n        {\n            get { return base.PrimaryNameServerAddresses; }\n            set\n            {\n                if ((value is null) || (value.Count == 0))\n                    throw new ArgumentException(\"At least one primary name server address must be specified for \" + GetZoneTypeName() + \" zone.\", nameof(PrimaryNameServerAddresses));\n\n                base.PrimaryNameServerAddresses = value;\n            }\n        }\n","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/SecondaryForwarderZone.cs#L121-L157","documentation":"Thrown by the SecondaryForwarderZone.Update setter when value is AllowOnlyZoneNameServers or AllowZoneNameServersAndUseSpecifiedNetworkACL. Dynamic updates are not authored on a secondary conditional forwarder (no name-server authority), so those modes are invalid; ArgumentException names the value.","triggerScenarios":"Setting zone.Update (Dynamic Updates) on a SecondaryForwarderZone to a name-server-based mode.","commonSituations":"Pushing a global dynamic-updates policy to every zone; copying update settings from an authoritative primary into a forwarder.","solutions":["Use Deny, Allow, AllowOnlyZoneNameServers-excluded, or UseSpecifiedNetworkACL as appropriate; for a forwarder prefer Deny.","Gate Update assignment by zone type.","Do not propagate name-server dynamic-update modes to forwarder zones."],"exampleFix":"// before\nzone.Update = AuthZoneUpdate.AllowOnlyZoneNameServers;\n\n// after\nzone.Update = AuthZoneUpdate.Deny;","handlingStrategy":"type-guard","validationCode":"static readonly HashSet<AuthZoneUpdate> ForwarderValid = new()\n{\n    AuthZoneUpdate.Deny, AuthZoneUpdate.Allow, AuthZoneUpdate.UseSpecifiedNetworkACL\n};\nif (ForwarderValid.Contains(value)) zone.Update = value;","typeGuard":"static bool IsValidForForwarder(AuthZoneUpdate v) =>\n    v != AuthZoneUpdate.AllowOnlyZoneNameServers &&\n    v != AuthZoneUpdate.AllowZoneNameServersAndUseSpecifiedNetworkACL;","tryCatchPattern":"null","preventionTips":["Prefer AuthZoneUpdate.Deny for secondary forwarder zones.","Gate dynamic-update assignment by zone type."],"tags":["dns","secondary-forwarder-zone","dynamic-updates","config","enum","zone-type"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}