| Previous | Next |
| DNS_ERROR_NO_VALID_TRUST_ANCHORS | DNS_ERROR_NSEC3_NAME_COLLISION |
DNS_ERROR_ROLLOVER_NOT_POKEABLE
DNS_ERROR_ROLLOVER_NOT_POKEABLE means Windows DNS Server cannot send the requested rollover notification because the selected key is not waiting for the parental DS update stage.
Check the key lifecycle state and whether a parental DS update is actually pending. The notification is meaningful only at the stage that expects parent-zone action, so forcing it earlier does not advance rollover safely.
What to check
- Inspect the key rollover state and verify that the key is in the expected phase.
- Confirm that the operation is being performed for a KSK workflow that actually involves parent delegation data.
- Do not retry the notification blindly; correct the schedule or wait for the current state transition.
Get-DnsServerSigningKey -ZoneName "example.com"Looking for a different code? Search another status or error code.