DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS: meaning and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS means the DNS zone lacks the required DNSSEC signing-key descriptors.

Previous	Next
DNS_ERROR_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1	DNS_ERROR_UNSUPPORTED_ALGORITHM

DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS

DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS means the zone lacks the signing-key configuration required to operate DNSSEC. A normally signed zone needs both a Key Signing Key (KSK) and a Zone Signing Key (ZSK) role.

Enumerate the existing signing-key descriptors and their roles before adding keys. The missing role or incomplete rollover state is more important than the raw key count, because duplicate descriptors do not satisfy the required signing topology.

What to check

List the signing keys and confirm that the zone has active keys for both KSK and ZSK responsibilities.
Check whether a previous key rollover removed, revoked, or failed to activate a required key.
Add or repair keys through the DNS Server DNSSEC cmdlets; do not create DNSKEY records manually.

Get-DnsServerSigningKey -ZoneName "example.com"

Microsoft: Add-DnsServerSigningKey

Microsoft: Sign DNS zones with DNSSEC

Microsoft: Test-DnsServerDnsSecZoneSetting

Looking for a different code? Search another status or error code.