| Previous | Next |
| DNS_ERROR_NOT_ALLOWED_ON_ZSK | DNS_ERROR_ROLLOVER_ALREADY_QUEUED |
DNS_ERROR_NOT_ALLOWED_ON_ACTIVE_SKD
DNS_ERROR_NOT_ALLOWED_ON_ACTIVE_SKD means the requested action cannot be applied to a signing-key descriptor while that key is active. Active keys participate in the zone's current validation chain.
Inspect the key state before changing its descriptor. If the requested maintenance requires an inactive or standby key, follow the supported rollover sequence instead of modifying a key that currently participates in signing.
What to check
- Inspect the key state and current rollover schedule.
- Use the supported lifecycle transition to move the key out of the active state before changing or removing it.
- For a KSK, account for parent DS records and resolver caches before making any transition.
Get-DnsServerSigningKey -ZoneName "example.com"Looking for a different code? Search another status or error code.