{"record":{"id":"8ecbd158447ea007","repo":"TechnitiumSoftware/DnsServer","slug":"the-zone-transfer-option-is-invalid-for-0-zones","errorCode":null,"errorMessage":"The Zone Transfer option is invalid for {0} zones: {1}","messagePattern":"The Zone Transfer option is invalid for (.+?) zones: (.+?)","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/ForwarderZone.cs","lineNumber":325,"sourceCode":"                    case AuthZoneQueryAccess.AllowOnlyZoneNameServers:\n                    case AuthZoneQueryAccess.AllowZoneNameServersAndUseSpecifiedNetworkACL:\n                        throw new ArgumentException(\"The Query Access option is invalid for \" + GetZoneTypeName() + \" zones: \" + value.ToString(), nameof(QueryAccess));\n                }\n\n                base.QueryAccess = value;\n            }\n        }\n\n        public override AuthZoneTransfer ZoneTransfer\n        {\n            get { return base.ZoneTransfer; }\n            set\n            {\n                switch (value)\n                {\n                    case AuthZoneTransfer.AllowOnlyZoneNameServers:\n                    case AuthZoneTransfer.AllowZoneNameServersAndUseSpecifiedNetworkACL:\n                        throw new ArgumentException(\"The Zone Transfer option is invalid for \" + GetZoneTypeName() + \" zones: \" + value.ToString(), nameof(ZoneTransfer));\n                }\n\n                base.ZoneTransfer = value;\n            }\n        }\n\n        public override AuthZoneNotify Notify\n        {\n            get { return base.Notify; }\n            set\n            {\n                switch (value)\n                {\n                    case AuthZoneNotify.ZoneNameServers:\n                    case AuthZoneNotify.BothZoneAndSpecifiedNameServers:\n                        throw new ArgumentException(\"The Notify option is invalid for \" + GetZoneTypeName() + \" zones: \" + value.ToString(), nameof(Notify));\n\n                    case AuthZoneNotify.SeparateNameServersForCatalogAndMemberZones:","sourceCodeStart":307,"sourceCodeEnd":343,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/ForwarderZone.cs#L307-L343","documentation":"Thrown by the ForwarderZone.ZoneTransfer property setter when value is AuthZoneTransfer.AllowOnlyZoneNameServers (2) or AllowZoneNameServersAndUseSpecifiedNetworkACL (4). Both modes gate AXFR/IXFR to the zone's authoritative name servers, which a Conditional Forwarder does not have (it is non-authoritative, holding a dummy SOA + FWD). Valid transfer options for a forwarder zone are Deny(0), Allow(1), and UseSpecifiedNetworkACL(3). ArgumentException names 'ZoneTransfer'.","triggerScenarios":"Assigning zone.ZoneTransfer = AuthZoneTransfer.AllowOnlyZoneNameServers (or ...AndUseSpecifiedNetworkACL) on a ForwarderZone, e.g. via zone settings API or a template applied across all zones.","commonSituations":"Applying a uniform 'zone transfer = name servers only' security template to every zone including forwarders; migrating settings from a primary zone; automated provisioning that does not branch on zone type.","solutions":["Use Deny, Allow, or UseSpecifiedNetworkACL for a ForwarderZone's ZoneTransfer.","Restrict the enum choices presented for forwarder zones in your provisioning/config layer.","If NS-restricted transfers are required, the zone should be a primary or secondary zone, not a conditional forwarder."],"exampleFix":"// before\nzone.ZoneTransfer = AuthZoneTransfer.AllowOnlyZoneNameServers;\n\n// after\nzone.ZoneTransfer = AuthZoneTransfer.UseSpecifiedNetworkACL;","handlingStrategy":"type-guard","validationCode":"var valid = new[] { AuthZoneTransfer.Deny, AuthZoneTransfer.Allow, AuthZoneTransfer.UseSpecifiedNetworkACL };\nif (!valid.Contains(value)) throw new ArgumentException($\"ZoneTransfer {value} not valid for forwarder zone.\");\nzone.ZoneTransfer = value;","typeGuard":"static bool IsValidForwarderZoneTransfer(AuthZoneTransfer v) => v == AuthZoneTransfer.Deny || v == AuthZoneTransfer.Allow || v == AuthZoneTransfer.UseSpecifiedNetworkACL;","tryCatchPattern":"try { zone.ZoneTransfer = value; }\ncatch (ArgumentException) { zone.ZoneTransfer = AuthZoneTransfer.UseSpecifiedNetworkACL; }","preventionTips":["For a ForwarderZone, only ZoneTransfer modes 0,1,3 are valid.","Do not apply primary-zone transfer templates to forwarders.","Surface zone-type-specific option sets in the UI."],"tags":["dns","forwarder-zone","zone-transfer","argumentexception","acl"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}