| Previous | Next |
| DNS_ERROR_NOT_ALLOWED_ON_ZSK | DNS_ERROR_ROLLOVER_ALREADY_QUEUED |
DNS_ERROR_NOT_ALLOWED_ON_ACTIVE_SKD
DNS_ERROR_NOT_ALLOWED_ON_ACTIVE_SKD means the requested action cannot be applied to a signing-key descriptor while that key is active. Active keys participate in the zone's current validation chain.
What to check
- Inspect the key state and current rollover schedule.
- Use the supported lifecycle transition to move the key out of the active state before changing or removing it.
- For a KSK, account for parent DS records and resolver caches before making any transition.
Get-DnsServerSigningKey -ZoneName "example.com"Microsoft: Sign DNS zones with DNSSEC
Microsoft: Test-DnsServerDnsSecZoneSetting
Looking for a different code? Search another status or error code.