projectdiscovery/nuclei · error

domain controller denied by network policy

Error message

domain controller denied by network policy

What it means

Sentinel error from the goexec helper. When auth.domain_controller is set (e.g. for Kerberos-based auth), the adapter additionally policy-checks that controller host: if protocolstate.IsHostAllowed rejects it, the run stops with ErrDomainControllerDenied before any connection is made (adapter_goexec.go:41-43). It protects against a policy being bypassed by routing through the DC.

Source

Thrown at pkg/js/libs/goexec/errors.go:17

package goexec

import "errors"

var (
	ErrMissingAuth             = errors.New("goexec auth is required")
	ErrMissingUsername         = errors.New("goexec username is required for this auth mode")
	ErrMultipleCredentialModes = errors.New("goexec auth selects multiple primary credential modes")
	ErrMissingTarget           = errors.New("goexec target is required")
	ErrMissingCommand          = errors.New("goexec command is required")
	ErrMissingExecutable       = errors.New("goexec executable is required")
	ErrUnsupportedModule       = errors.New("unsupported goexec module")
	ErrUnsupportedMethod       = errors.New("unsupported goexec method")
	ErrUnsupportedOutputMethod = errors.New("unsupported goexec output method")
	ErrNetworkPolicyDenied     = errors.New("target denied by network policy")
	ErrInvalidMethodArguments  = errors.New("invalid goexec method arguments")
	ErrDomainControllerDenied  = errors.New("domain controller denied by network policy")
	ErrProxyDenied             = errors.New("proxy denied by network policy")
	ErrEndpointDenied          = errors.New("endpoint denied by network policy")
)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Add the domain controller's IP/CIDR to the network policy allow list
2. Drop the domain-controller option if the selected auth mode does not require it
3. Pre-check the DC host with protocolstate.IsHostAllowed and fail early with a clear message

if req.Auth.domainController != "" && !protocolstate.IsHostAllowed(executionID, targetHost(req.Auth.domainController)) {
    return errors.New("domain controller blocked by network policy")
}

func isDomainControllerDenied(err error) bool { return errors.Is(err, goexec.ErrDomainControllerDenied) }

When it happens

Trigger: A goexec request with auth: {domain-controller: 'dc.corp.local', ...} where dc.corp.local resolves to an IP not permitted by the configured network policy.

Common situations: Target host is allowed but the domain controller sits on a management subnet that the policy excludes; hardened CI policies that only allow the single target CIDR.

Related errors

• target denied by network policy
• proxy denied by network policy
• invalid ASRepRoastRequest: %w
• Username, Domain and KDCHost are required
• invalid KerberoastRequest: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/8c9048d7f7303e49. Report an issue: GitHub.