| Previous | Next |
| DNS_ERROR_SIGNING_KEY_NOT_ACCESSIBLE | DNS_ERROR_UNEXPECTED_DATA_PROTECTION_ERROR |
DNS_ERROR_KSP_DOES_NOT_SUPPORT_PROTECTION
DNS_ERROR_KSP_DOES_NOT_SUPPORT_PROTECTION means the selected CNG Key Storage Provider (KSP) cannot provide the data-protection capability required by Windows DNS Server for the signing key.
Confirm the provider selected for the signing key and its protection capabilities before generating replacement keys. Moving to a compatible provider is preferable to weakening protection requirements around a provider that cannot meet them.
What to check
- Identify the KSP backing the signing key and verify that it is supported for DNS Server DNSSEC use on this host.
- Check whether a provider change, HSM configuration, or migration introduced the key.
- Generate a replacement key with a compatible provider only after planning its rollover and delegation impact.
Get-DnsServerSigningKey -ZoneName "example.com"Microsoft: Sign DNS zones with DNSSEC
Looking for a different code? Search another status or error code.