| Previous | Next |
| DNS_ERROR_INVALID_SIGNATURE_VALIDITY_PERIOD | DNS_ERROR_DNSSEC_IS_DISABLED |
DNS_ERROR_INVALID_NSEC3_ITERATION_COUNT
DNS_ERROR_INVALID_NSEC3_ITERATION_COUNT means the requested NSEC3 iteration count exceeds what Windows DNS Server permits for the minimum key length in the zone. NSEC3 parameters must remain compatible with the signing keys.
What to check
- Review the lengths of all active KSK and ZSK keys, including keys that are about to participate in rollover.
- Reduce the iteration count or choose a compatible signing-key configuration.
- Test the complete DNSSEC configuration before committing the new NSEC3 parameters.
Get-DnsServerSigningKey -ZoneName "example.com"Microsoft: Sign DNS zones with DNSSEC
Microsoft: Test-DnsServerDnsSecZoneSetting
Microsoft: Add-DnsServerSigningKey
Looking for a different code? Search another status or error code.