What does Windows error code 9106 (DNS_ERROR_INVALID_KEY_SIZE) mean?

 
Previous Next
DNS_ERROR_UNSUPPORTED_ALGORITHM DNS_ERROR_SIGNING_KEY_NOT_ACCESSIBLE

DNS_ERROR_INVALID_KEY_SIZE

DNS_ERROR_INVALID_KEY_SIZE means the requested key length is not valid for the selected DNSSEC signing algorithm. The algorithm and key size must be chosen as a supported pair.

Read the supported key-size range for the chosen algorithm from the DNS Server tooling on the target system. Reusing a size from another algorithm can fail even when both algorithms are otherwise supported for DNSSEC.

What to check

  • Review the intended algorithm and its supported key lengths in the DNS Server signing-key command documentation.
  • Check whether the error occurs while generating a KSK or a ZSK; do not assume that the same size is appropriate for both roles.
  • Validate the zone configuration after changing the key parameters.
Add-DnsServerSigningKey -ZoneName "example.com" -Type ZoneSigningKey

Microsoft: Add-DnsServerSigningKey

Microsoft: Sign DNS zones with DNSSEC

Microsoft: Test-DnsServerDnsSecZoneSetting

Looking for a different code? Search another status or error code.