| Previous | Next |
| DNS_ERROR_KEYMASTER_REQUIRED | DNS_ERROR_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1 |
DNS_ERROR_NOT_ALLOWED_ON_SIGNED_ZONE
DNS_ERROR_NOT_ALLOWED_ON_SIGNED_ZONE means the requested change is incompatible with the current DNSSEC state of the zone. A signed zone or a zone that already has signing keys has additional integrity constraints that ordinary unsigned-zone operations do not have.
What to check
- Verify whether the zone is signed and inspect its DNSSEC settings before changing its type, signing parameters, or DNSSEC-related metadata.
- Determine whether the intended operation needs a documented DNSSEC workflow, such as key rollover or unsigning the zone.
- Do not remove DNSKEY, RRSIG, NSEC, or NSEC3 records by hand to bypass the restriction.
Get-DnsServerZone -Name "example.com"Microsoft: Sign DNS zones with DNSSEC
Microsoft: Get-DnsServerDnsSecZoneSetting
Microsoft: Validate DNSSEC responses
Looking for a different code? Search another status or error code.