{"record":{"id":"af2393bcb0bc866e","repo":"TechnitiumSoftware/DnsServer","slug":"cannot-add-record-disabling-records-in-a-signed-z","errorCode":null,"errorMessage":"Cannot add record: disabling records in a signed zones is not supported.","messagePattern":"Cannot add record: disabling records in a signed zones is not supported\\.","errorType":"exception","errorClass":"DnsServerException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/PrimarySubDomainZone.cs","lineNumber":121,"sourceCode":"\n                    _primaryZone.TriggerNotify();\n                    break;\n            }\n        }\n\n        public override bool AddRecord(DnsResourceRecord record)\n        {\n            if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)\n            {\n                switch (record.Type)\n                {\n                    case DnsResourceRecordType.ANAME:\n                    case DnsResourceRecordType.APP:\n                        throw new DnsServerException(\"The record type is not supported by DNSSEC signed primary zones.\");\n\n                    default:\n                        if (record.GetAuthGenericRecordInfo().Disabled)\n                            throw new DnsServerException(\"Cannot add record: disabling records in a signed zones is not supported.\");\n\n                        break;\n                }\n            }\n\n            switch (record.Type)\n            {\n                case DnsResourceRecordType.DNSKEY:\n                case DnsResourceRecordType.RRSIG:\n                case DnsResourceRecordType.NSEC:\n                case DnsResourceRecordType.NSEC3PARAM:\n                case DnsResourceRecordType.NSEC3:\n                    throw new InvalidOperationException(\"Cannot add DNSSEC record.\");\n\n                case DnsResourceRecordType.FWD:\n                    throw new DnsServerException(\"The record type is not supported by primary zones.\");\n\n                default:","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/PrimarySubDomainZone.cs#L103-L139","documentation":"Thrown by PrimarySubDomainZone.AddRecord() inside the DNSSEC guard when record.GetAuthGenericRecordInfo().Disabled == true and the parent zone is signed. Same rule as error 491 but on the single-record AddRecord path: a disabled record inside a signed RRset would desync the DNSSEC signatures, so the add is rejected before writing. DnsServerException, catchable.","triggerScenarios":"zone.AddRecord(record) on a signed PrimarySubDomainZone where record was constructed/marked Disabled=true (parked/staged record).","commonSituations":"Pre-disabling records for staged rollout; importing a 'parked' record set into a signed zone; client code that defaults new records to Disabled.","solutions":["Do not mark records Disabled in a signed zone; add them active or omit them.","Set record.GetAuthGenericRecordInfo().Disabled = false before AddRecord when the zone is signed.","For staged rollout on signed zones, add/remove records rather than toggling Disabled."],"exampleFix":"// before\nrecord.GetAuthGenericRecordInfo().Disabled = true;\nzone.AddRecord(record);\n\n// after (signed zone)\nrecord.GetAuthGenericRecordInfo().Disabled = false;\nzone.AddRecord(record);","handlingStrategy":"validation","validationCode":"if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)\n    record.GetAuthGenericRecordInfo().Disabled = false;\nzone.AddRecord(record);","typeGuard":"static bool IsAddableInSignedZone(DnsResourceRecord r, AuthZoneDnssecStatus s) => s == AuthZoneDnssecStatus.Unsigned || !r.GetAuthGenericRecordInfo().Disabled;","tryCatchPattern":"try { zone.AddRecord(record); }\ncatch (DnsServerException ex) when (ex.Message.Contains(\"disabling records\")) { record.GetAuthGenericRecordInfo().Disabled = false; zone.AddRecord(record); }","preventionTips":["Never construct new records with Disabled=true for a signed zone.","Add/remove records to stage rollouts on signed zones instead of toggling Disabled.","Validate !Disabled before AddRecord when the zone is signed."],"tags":["dns","primary-zone","subdomain","dnssec","disabled-record","dnsserverexception"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}