| Previous | Next |
| DNS_ERROR_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1 | DNS_ERROR_UNSUPPORTED_ALGORITHM |
DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS
DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS means the zone lacks the signing-key configuration required to operate DNSSEC. A normally signed zone needs both a Key Signing Key (KSK) and a Zone Signing Key (ZSK) role.
What to check
- List the signing keys and confirm that the zone has active keys for both KSK and ZSK responsibilities.
- Check whether a previous key rollover removed, revoked, or failed to activate a required key.
- Add or repair keys through the DNS Server DNSSEC cmdlets; do not create DNSKEY records manually.
Get-DnsServerSigningKey -ZoneName "example.com"Microsoft: Add-DnsServerSigningKey
Microsoft: Sign DNS zones with DNSSEC
Microsoft: Test-DnsServerDnsSecZoneSetting
Looking for a different code? Search another status or error code.