| Previous | Next |
| DNS_ERROR_ROLLOVER_NOT_POKEABLE | DNS_ERROR_NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1 |
DNS_ERROR_NSEC3_NAME_COLLISION
DNS_ERROR_NSEC3_NAME_COLLISION means Windows DNS Server detected a hash collision while building NSEC3 records for the zone. The zone cannot safely continue signing with the current NSEC3 salt and parameters.
What to check
- Review the NSEC3 salt and other configured parameters.
- Use a newly generated salt or another supported NSEC/NSEC3 configuration, then validate the zone settings before signing again.
- Do not manually delete generated denial-of-existence records as a workaround.
Test-DnsServerDnsSecZoneSetting -ZoneName "example.com"Microsoft: Sign DNS zones with DNSSEC
Microsoft: Test-DnsServerDnsSecZoneSetting
Microsoft: Validate DNSSEC responses
Looking for a different code? Search another status or error code.