{"record":{"id":"f741fb9dce977a3b","repo":"TechnitiumSoftware/DnsServer","slug":"tsig-keys-cannot-have-more-than-255-entries","errorCode":null,"errorMessage":"TSIG keys cannot have more than 255 entries.","messagePattern":"TSIG keys cannot have more than 255 entries\\.","errorType":"exception","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/DnsServer.cs","lineNumber":7857,"sourceCode":"                    _dnsOverHttpRealIpHeader = \"X-Real-IP\";\n                else if (value.Length > 255)\n                    throw new ArgumentException(\"DNS-over-HTTP Real IP header name cannot exceed 255 characters.\", nameof(DnsOverHttpRealIpHeader));\n                else if (value.Contains(' '))\n                    throw new ArgumentException(\"DNS-over-HTTP Real IP header name cannot contain invalid characters.\", nameof(DnsOverHttpRealIpHeader));\n                else\n                    _dnsOverHttpRealIpHeader = value;\n            }\n        }\n\n        public IReadOnlyDictionary<string, TsigKey> TsigKeys\n        {\n            get { return _tsigKeys; }\n            set\n            {\n                if ((value is null) || (value.Count == 0))\n                    _tsigKeys = null;\n                else if (value.Count > byte.MaxValue)\n                    throw new ArgumentOutOfRangeException(nameof(TsigKeys), \"TSIG keys cannot have more than 255 entries.\");\n                else\n                    _tsigKeys = value;\n            }\n        }\n\n        public DnsServerRecursion Recursion\n        {\n            get { return _recursion; }\n            set\n            {\n                if (_recursion != value)\n                {\n                    if ((_recursion == DnsServerRecursion.Deny) || (value == DnsServerRecursion.Deny))\n                    {\n                        _recursion = value;\n                        ResetPrefetchTimers();\n                    }\n                    else","sourceCodeStart":7839,"sourceCodeEnd":7875,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/DnsServer.cs#L7839-L7875","documentation":"Thrown by the TsigKeys property setter when the supplied dictionary contains more than 255 entries. The 255 limit exists because the count is serialized into a single byte on disk/in the cluster protocol, so exceeding it would overflow the wire format. TSIG (RFC 2845) keys authenticate zone transfers and dynamic updates.","triggerScenarios":"Assigning an IReadOnlyDictionary<string, TsigKey> with Count > byte.MaxValue (255) to DnsServer.TsigKeys.","commonSituations":"Bulk-importing a large keyring from another DNS server; auto-generating per-zone TSIG keys at scale; migrating a multi-tenant setup that provisions one key per tenant.","solutions":["Reduce the key set to 255 or fewer entries by consolidating shared keys across zones.","Audit for stale/duplicate keys and remove ones no longer referenced by any zone or peer.","If you genuinely need more, re-architect so only the active subset is loaded at once."],"exampleFix":"// before\nserver.TsigKeys = allKeys; // allKeys.Count == 300\n\n// after\nserver.TsigKeys = allKeys.Take(255).ToDictionary(k => k.Key, k => k.Value);","handlingStrategy":"validation","validationCode":"const int MaxTsigKeys = 255;\nif (keys.Count > MaxTsigKeys)\n    throw new InvalidOperationException($\"TSIG key set has {keys.Count} entries; max is {MaxTsigKeys}.\");\nserver.TsigKeys = keys;","typeGuard":"static bool WithinTsigLimit(IReadOnlyDictionary<string, TsigKey> keys) =>\n    keys is null || keys.Count <= 255;","tryCatchPattern":"try { server.TsigKeys = keys; }\ncatch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(server.TsigKeys))\n{\n    logger.Error(\"Too many TSIG keys supplied; loading first 255 only.\");\n    server.TsigKeys = keys.Take(255).ToDictionary(k => k.Key, k => k.Value);\n}","preventionTips":["Keep a single shared TSIG key per peer rather than per-zone.","Periodically prune unused TSIG keys.","Assert collection sizes at config-load time."],"tags":["dns","configuration","validation","tsig","limits"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}