| Previous | Next |
| DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED_ZONE | DNS_ERROR_INVALID_SIGNATURE_VALIDITY_PERIOD |
DNS_ERROR_BAD_KEYMASTER
DNS_ERROR_BAD_KEYMASTER means the DNS server designated as Key Master for the zone is unavailable or misconfigured. Key generation and rollover management cannot proceed through that server.
What to check
- Verify that the current Key Master is online, authoritative for the primary zone, and reachable from the management host.
- Review DNS Server events and zone replication before changing the role.
- Transfer the role through the documented procedure; use role seizure only when the current Key Master cannot be recovered and the operational consequences are understood.
Reset-DnsServerZoneKeyMasterRole -ZoneName "example.com" -KeyMasterServer "dns02.example.com"Microsoft: Transfer the DNSSEC Key Master role
Microsoft: Reset-DnsServerZoneKeyMasterRole
Looking for a different code? Search another status or error code.