Windows error 9121 (DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The requested DNSSEC operation requires a DNSSEC-signed zone, but the zone is unsigned.

Previous	Next
DNS_ERROR_ROLLOVER_ALREADY_QUEUED	DNS_ERROR_BAD_KEYMASTER

DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED_ZONE

DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED_ZONE means the requested action applies only to a DNSSEC-signed zone. The zone has no active signing configuration for the operation to modify.

What to check

Confirm that the intended zone is the correct one and check its IsSigned state.
If DNSSEC is required, sign the authoritative primary zone using a planned rollout rather than enabling isolated records manually.
If the zone is intentionally unsigned, remove DNSSEC-specific actions from the automation or deployment workflow.

Get-DnsServerZone -Name "example.com"

Microsoft: Sign DNS zones with DNSSEC

Microsoft: Validate DNSSEC responses

Microsoft: Get-DnsServerDnsSecZoneSetting

Looking for a different code? Search another status or error code.