| Previous | Next |
| DNS_ERROR_RCODE_BADTIME | DNS_ERROR_NOT_ALLOWED_ON_SIGNED_ZONE |
DNS_ERROR_KEYMASTER_REQUIRED
DNS_ERROR_KEYMASTER_REQUIRED means that the requested DNSSEC signing-key operation was sent to an authoritative DNS server that is not the zone's Key Master. The Key Master generates and manages signing keys for a signed zone.
What to check
- Confirm that the target server hosts a primary, authoritative copy of the zone and identify the current Key Master.
- Run the key-management action on the current Key Master instead of on a secondary or another authoritative server.
- When the role must move, use the documented Key Master transfer procedure rather than manually changing zone records.
Get-DnsServerDnsSecZoneSetting -ZoneName "example.com"Microsoft: Get-DnsServerDnsSecZoneSetting
Microsoft: Transfer the DNSSEC Key Master role
Looking for a different code? Search another status or error code.