| Previous | Next |
| DNS_ERROR_KSP_NOT_ACCESSIBLE | DNS_ERROR_INVALID_ROLLOVER_PERIOD |
DNS_ERROR_TOO_MANY_SKDS
DNS_ERROR_TOO_MANY_SKDS means Windows DNS Server cannot add another signing-key descriptor for the same algorithm and KSK/ZSK role. The existing rollover state must be reviewed before creating more keys.
What to check
- List active, standby, revoked, and rolling-over keys for the zone.
- Check whether an earlier rollover was left incomplete or queued twice.
- Remove or retire keys only through the documented rollover lifecycle, after confirming that dependent DS and DNSKEY records are safe.
Get-DnsServerSigningKey -ZoneName "example.com"Microsoft: Add-DnsServerSigningKey
Microsoft: Sign DNS zones with DNSSEC
Microsoft: Test-DnsServerDnsSecZoneSetting
Looking for a different code? Search another status or error code.