{"record":{"id":"ea72efada2a2b06e","repo":"TechnitiumSoftware/DnsServer","slug":"the-dynamic-updates-option-is-invalid-for-0-zone","errorCode":null,"errorMessage":"The Dynamic Updates option is invalid for {0} zones: {1}","messagePattern":"The Dynamic Updates option is invalid for (.+?) zones: (.+?)","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/ForwarderZone.cs","lineNumber":363,"sourceCode":"                            break;\n\n                        throw new ArgumentException(\"The Notify option is invalid for \" + GetZoneTypeName() + \" zones: \" + value.ToString(), nameof(Notify));\n                }\n\n                base.Notify = value;\n            }\n        }\n\n        public override AuthZoneUpdate Update\n        {\n            get { return base.Update; }\n            set\n            {\n                switch (value)\n                {\n                    case AuthZoneUpdate.AllowOnlyZoneNameServers:\n                    case AuthZoneUpdate.AllowZoneNameServersAndUseSpecifiedNetworkACL:\n                        throw new ArgumentException(\"The Dynamic Updates option is invalid for \" + GetZoneTypeName() + \" zones: \" + value.ToString(), nameof(Update));\n                }\n\n                base.Update = value;\n            }\n        }\n\n        #endregion\n    }\n}\n","sourceCodeStart":345,"sourceCodeEnd":373,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/ForwarderZone.cs#L345-L373","documentation":"Thrown by the ForwarderZone.Update property setter when value is AuthZoneUpdate.AllowOnlyZoneNameServers (2) or AuthZoneUpdate.AllowZoneNameServersAndUseSpecifiedNetworkACL (4). Dynamic DNS updates (RFC 2136) gated to 'zone name servers' require an authoritative NS set, which a Conditional Forwarder lacks; the zone only forwards queries, it does not accept dynamic updates from NS peers. Valid update options for a forwarder zone are Deny(0), Allow(1), and UseSpecifiedNetworkACL(3). ArgumentException names 'Update'.","triggerScenarios":"Assigning zone.Update = AuthZoneUpdate.AllowOnlyZoneNameServers (or ...AndUseSpecifiedNetworkACL) on a ForwarderZone, typically via the dynamic-updates setting in the zone API or an import.","commonSituations":"Enabling RFC 2136 dynamic updates with a name-server ACL on a forwarder by mistake; copying primary-zone update settings; provisioning scripts that set the same Update enum for every zone.","solutions":["For a ForwarderZone use Update = Deny, Allow, or UseSpecifiedNetworkACL.","If you genuinely need NS-authenticated dynamic updates, use a primary zone instead of a conditional forwarder.","Filter the Update enum options by zone type in your settings surface."],"exampleFix":"// before\nzone.Update = AuthZoneUpdate.AllowOnlyZoneNameServers;\n\n// after\nzone.Update = AuthZoneUpdate.UseSpecifiedNetworkACL;","handlingStrategy":"type-guard","validationCode":"var valid = new[] { AuthZoneUpdate.Deny, AuthZoneUpdate.Allow, AuthZoneUpdate.UseSpecifiedNetworkACL };\nif (!valid.Contains(value)) throw new ArgumentException($\"Update {value} not valid for forwarder zone.\");\nzone.Update = value;","typeGuard":"static bool IsValidForwarderUpdate(AuthZoneUpdate v) => v == AuthZoneUpdate.Deny || v == AuthZoneUpdate.Allow || v == AuthZoneUpdate.UseSpecifiedNetworkACL;","tryCatchPattern":"try { zone.Update = value; }\ncatch (ArgumentException) { zone.Update = AuthZoneUpdate.UseSpecifiedNetworkACL; }","preventionTips":["For a ForwarderZone, only Dynamic Update modes 0,1,3 are valid.","NS-authenticated dynamic updates require a primary zone, not a forwarder.","Filter the Update enum by zone type in provisioning scripts."],"tags":["dns","forwarder-zone","dynamic-update","argumentexception","acl"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}