{"record":{"id":"bdb01cbe321b1d05","repo":"TechnitiumSoftware/DnsServer","slug":"the-record-type-is-not-supported-by-dnssec-signed","errorCode":null,"errorMessage":"The record type is not supported by DNSSEC signed primary zones.","messagePattern":"The record type is not supported by DNSSEC signed primary zones\\.","errorType":"exception","errorClass":"DnsServerException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/PrimarySubDomainZone.cs","lineNumber":64,"sourceCode":"\n        internal override IReadOnlyList<DnsResourceRecord> SignRRSet(IReadOnlyList<DnsResourceRecord> records)\n        {\n            return _primaryZone.SignRRSet(records);\n        }\n\n        #endregion\n\n        #region public\n\n        public override void SetRecords(DnsResourceRecordType type, IReadOnlyList<DnsResourceRecord> records)\n        {\n            if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)\n            {\n                switch (type)\n                {\n                    case DnsResourceRecordType.ANAME:\n                    case DnsResourceRecordType.APP:\n                        throw new DnsServerException(\"The record type is not supported by DNSSEC signed primary zones.\");\n\n                    default:\n                        foreach (DnsResourceRecord record in records)\n                        {\n                            if (record.GetAuthGenericRecordInfo().Disabled)\n                                throw new DnsServerException(\"Cannot set records: disabling records in a signed zones is not supported.\");\n                        }\n\n                        break;\n                }\n            }\n\n            switch (type)\n            {\n                case DnsResourceRecordType.SOA:\n                    throw new InvalidOperationException(\"Cannot set SOA record on sub domain.\");\n\n                case DnsResourceRecordType.DNSKEY:","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/PrimarySubDomainZone.cs#L46-L82","documentation":"Thrown by PrimarySubDomainZone.SetRecords() when the parent primary zone is DNSSEC-signed (DnssecStatus != Unsigned) and the requested type is ANAME or APP. ANAME and APP records are resolved dynamically by the server (ANAME resolves an address, APP delegates to an app plugin), so their answers are not stable RRsets that can be cryptographically signed — adding them to a signed zone would break DNSSEC validation. The guard fires before any record is written. DnsServerException (domain error, catchable).","triggerScenarios":"zone.SetRecords(DnsResourceRecordType.ANAME, records) or SetRecords(DnsResourceRecordType.APP, ...) on a PrimarySubDomainZone whose parent PrimaryZone.DnssecStatus is SignedWithNSEC or SignedWithNSEC3. Happens when DNSSEC is enabled on a zone that already contains, or is being loaded with, ANAME/APP records.","commonSituations":"Turning on DNSSEC signing on a primary zone that uses ANAME for dynamic IP scenarios; importing a zone file containing ANAME records into a signed zone; app-based (APP) records combined with signing.","solutions":["Do not use ANAME or APP records in a DNSSEC-signed zone; replace ANAME with static A/AAAA records.","If ANAME dynamic resolution is required, disable DNSSEC signing on that primary zone.","Filter ANAME/APP out of the record set before calling SetRecords when DnssecStatus != Unsigned."],"exampleFix":"// before\nzone.SetRecords(DnsResourceRecordType.ANAME, new[] { anameRecord });\n\n// after\nif (primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned)\n    zone.SetRecords(DnsResourceRecordType.A, new[] { staticARecord }); // signable type\nelse\n    zone.SetRecords(DnsResourceRecordType.ANAME, new[] { anameRecord });","handlingStrategy":"validation","validationCode":"if (_primaryZone.DnssecStatus != AuthZoneDnssecStatus.Unsigned && (type == DnsResourceRecordType.ANAME || type == DnsResourceRecordType.APP))\n    throw new InvalidOperationException(\"ANAME/APP not supported in signed zones; use A/AAAA.\");\nzone.SetRecords(type, records);","typeGuard":"static bool IsSignableRecordType(DnsResourceRecordType type, AuthZoneDnssecStatus status) => status == AuthZoneDnssecStatus.Unsigned || (type != DnsResourceRecordType.ANAME && type != DnsResourceRecordType.APP);","tryCatchPattern":"try { zone.SetRecords(type, records); }\ncatch (DnsServerException ex) when (ex.Message.Contains(\"DNSSEC signed primary zones\")) { /* switch to static A/AAAA or disable signing */ }","preventionTips":["Never use ANAME/APP in a zone you intend to DNSSEC-sign.","Check DnssecStatus before allowing ANAME/APP record creation.","Replace ANAME dynamic resolution with static A/AAAA when signing is on."],"tags":["dns","primary-zone","subdomain","dnssec","aname","dnsserverexception"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}