| Previous | Next |
| DNS_ERROR_STANDBY_KEY_NOT_PRESENT | DNS_ERROR_NOT_ALLOWED_ON_ACTIVE_SKD |
DNS_ERROR_NOT_ALLOWED_ON_ZSK
DNS_ERROR_NOT_ALLOWED_ON_ZSK means the requested action applies to a Key Signing Key or to another key state, not to the selected Zone Signing Key (ZSK).
Check the selected key role before applying KSK-oriented maintenance. KSK and ZSK lifecycle operations are not interchangeable, even when both keys use the same algorithm and are present in the same signed zone.
What to check
- Confirm whether the selected key is a KSK or a ZSK and what the intended operation changes.
- Use a key of the required role instead of trying to force the operation on the ZSK.
- Review key states before scheduling rollovers or modifying DNSSEC delegation information.
Get-DnsServerSigningKey -ZoneName "example.com"Microsoft: Add-DnsServerSigningKey
Looking for a different code? Search another status or error code.