| Previous | Next |
| DNS_ERROR_NOT_ALLOWED_ON_SIGNED_ZONE | DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS |
DNS_ERROR_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1
DNS_ERROR_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1 identifies an invalid DNSSEC combination: the zone is configured to use NSEC3 while a signing key uses the RSA/SHA-1 algorithm. Windows DNS Server treats these settings as incompatible.
What to check
- Review every KSK and ZSK in the zone, not only the key being added.
- Choose a compatible authenticated-denial-of-existence method and signing algorithm before changing the zone configuration.
- Validate the planned settings before applying them to the production zone.
Get-DnsServerSigningKey -ZoneName "example.com"Microsoft: Sign DNS zones with DNSSEC
Microsoft: Test-DnsServerDnsSecZoneSetting
Microsoft: Add-DnsServerSigningKey
Looking for a different code? Search another status or error code.