{"record":{"id":"8bd60fcf40fc0d98","repo":"TechnitiumSoftware/DnsServer","slug":"cannot-set-records-disabling-records-in-a-signed","errorCode":null,"errorMessage":"Cannot set records: disabling records in a signed zones is not supported.","messagePattern":"Cannot set records: disabling records in a signed zones is not supported\\.","errorType":"exception","errorClass":"DnsServerException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/PrimarySubDomainZone.cs","lineNumber":70,"sourceCode":"        #endregion\n\n        #region public\n\n        public override void SetRecords(DnsResourceRecordType type, IReadOnlyList<DnsResourceRecord> records)\n        {\n            if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)\n            {\n                switch (type)\n                {\n                    case DnsResourceRecordType.ANAME:\n                    case DnsResourceRecordType.APP:\n                        throw new DnsServerException(\"The record type is not supported by DNSSEC signed primary zones.\");\n\n                    default:\n                        foreach (DnsResourceRecord record in records)\n                        {\n                            if (record.GetAuthGenericRecordInfo().Disabled)\n                                throw new DnsServerException(\"Cannot set records: disabling records in a signed zones is not supported.\");\n                        }\n\n                        break;\n                }\n            }\n\n            switch (type)\n            {\n                case DnsResourceRecordType.SOA:\n                    throw new InvalidOperationException(\"Cannot set SOA record on sub domain.\");\n\n                case DnsResourceRecordType.DNSKEY:\n                case DnsResourceRecordType.RRSIG:\n                case DnsResourceRecordType.NSEC:\n                case DnsResourceRecordType.NSEC3PARAM:\n                case DnsResourceRecordType.NSEC3:\n                    throw new InvalidOperationException(\"Cannot set DNSSEC records.\");\n","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/PrimarySubDomainZone.cs#L52-L88","documentation":"Thrown by PrimarySubDomainZone.SetRecords() inside the DNSSEC guard when any record in the set has GetAuthGenericRecordInfo().Disabled == true and the parent zone is signed. A 'disabled' record is served with the existing RRset but excluded from answers, and DNSSEC signing expects every stored record in an RRset to be part of the signed set — disabling records mid-RRset would desync signatures and let validators detect tampering. The message contains a typo ('a signed zones') but the condition is exact. DnsServerException, catchable.","triggerScenarios":"zone.SetRecords(type, records) on a signed PrimarySubDomainZone where one or more records were created/marked Disabled=true (e.g. via the UI 'disable record' toggle) before the set call.","commonSituations":"Bulk import of records that preserves a 'disabled/parked' flag; scripted provisioning that pre-disables records for staged rollout; re-enabling records but forgetting to clear Disabled on a signed zone.","solutions":["Do not set Disabled=true on records in a DNSSEC-signed zone; enable/disable by toggling the whole RRset or by removing the record instead.","Clear record.GetAuthGenericRecordInfo().Disabled = false before calling SetRecords when the zone is signed.","If staged rollout is needed, disable DNSSEC or add/remove records rather than marking them disabled."],"exampleFix":"// before\nrec.GetAuthGenericRecordInfo().Disabled = true;\nzone.SetRecords(type, new[] { rec });\n\n// after (signed zone)\nrec.GetAuthGenericRecordInfo().Disabled = false;\nzone.SetRecords(type, new[] { rec });\n// to hide it, omit it from the set instead of disabling it","handlingStrategy":"validation","validationCode":"if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)\n    foreach (var r in records)\n        r.GetAuthGenericRecordInfo().Disabled = false;\nzone.SetRecords(type, records);","typeGuard":"static bool NoDisabledRecords(IReadOnlyList<DnsResourceRecord> records) => records.All(r => !r.GetAuthGenericRecordInfo().Disabled);","tryCatchPattern":"try { zone.SetRecords(type, records); }\ncatch (DnsServerException ex) when (ex.Message.Contains(\"disabling records\")) { /* clear Disabled and retry */ }","preventionTips":["Do not mark records Disabled in a signed zone; remove them instead.","Validate that no record in the set is Disabled before SetRecords on a signed zone.","Stage rollouts by add/remove, not by the Disabled flag, when DNSSEC is enabled."],"tags":["dns","primary-zone","subdomain","dnssec","disabled-record","dnsserverexception"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}