{"record":{"id":"ad1cd2de06dc8fbd","repo":"TechnitiumSoftware/DnsServer","slug":"the-query-access-option-is-invalid-for-secondary-c","errorCode":null,"errorMessage":"The Query Access option is invalid for Secondary Conditional Forwarder zones: {value}","messagePattern":"The Query Access option is invalid for Secondary Conditional Forwarder zones: (.+?)","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/SecondaryForwarderZone.cs","lineNumber":111,"sourceCode":"            set { throw new InvalidOperationException(); }\n        }\n\n        public override bool OverrideCatalogPrimaryNameServers\n        {\n            get { throw new InvalidOperationException(); }\n            set { throw new InvalidOperationException(); }\n        }\n\n        public override AuthZoneQueryAccess QueryAccess\n        {\n            get { return base.QueryAccess; }\n            set\n            {\n                switch (value)\n                {\n                    case AuthZoneQueryAccess.AllowOnlyZoneNameServers:\n                    case AuthZoneQueryAccess.AllowZoneNameServersAndUseSpecifiedNetworkACL:\n                        throw new ArgumentException(\"The Query Access option is invalid for Secondary Conditional Forwarder zones: \" + value.ToString(), nameof(QueryAccess));\n                }\n\n                base.QueryAccess = value;\n            }\n        }\n\n        public override AuthZoneTransfer ZoneTransfer\n        {\n            get { return base.ZoneTransfer; }\n            set { throw new InvalidOperationException(); }\n        }\n\n        public override AuthZoneNotify Notify\n        {\n            get { return base.Notify; }\n            set { throw new InvalidOperationException(); }\n        }\n","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/SecondaryForwarderZone.cs#L93-L129","documentation":"Thrown by the SecondaryForwarderZone.QueryAccess setter when value is AllowOnlyZoneNameServers or AllowZoneNameServersAndUseSpecifiedNetworkACL. A secondary conditional-forwarder zone has no authoritative name-server list of its own (it forwards), so the name-server-based query-access modes are meaningless and rejected with ArgumentException.","triggerScenarios":"Setting zone.QueryAccess on a SecondaryForwarderZone (Secondary Conditional Forwarder) to one of the two name-server-based ACL modes.","commonSituations":"Applying a uniform query-access policy to all zones including forwarders; importing settings from a primary/secondary zone into a forwarder zone.","solutions":["Use Deny, Allow, AllowOnlyPrivateNetworks, or UseSpecifiedNetworkACL for a secondary forwarder zone.","Branch query-access assignment by zone type so forwarders never get name-server modes.","Strip name-server ACL modes when cloning zone options into a forwarder."],"exampleFix":"// before\nzone.QueryAccess = AuthZoneQueryAccess.AllowOnlyZoneNameServers;\n\n// after\nzone.QueryAccess = AuthZoneQueryAccess.UseSpecifiedNetworkACL;","handlingStrategy":"type-guard","validationCode":"static readonly HashSet<AuthZoneQueryAccess> ForwarderValid = new()\n{\n    AuthZoneQueryAccess.Deny, AuthZoneQueryAccess.Allow,\n    AuthZoneQueryAccess.AllowOnlyPrivateNetworks, AuthZoneQueryAccess.UseSpecifiedNetworkACL\n};\nif (ForwarderValid.Contains(value)) zone.QueryAccess = value;","typeGuard":"static bool IsValidForForwarder(AuthZoneQueryAccess v) =>\n    v != AuthZoneQueryAccess.AllowOnlyZoneNameServers &&\n    v != AuthZoneQueryAccess.AllowZoneNameServersAndUseSpecifiedNetworkACL;","tryCatchPattern":"null","preventionTips":["Branch query-access policy by zone type.","Do not clone primary-zone ACL modes into forwarder zones."],"tags":["dns","secondary-forwarder-zone","query-access","config","enum","zone-type"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}