| Previous | Next |
| DNS_ERROR_NSEC3_NAME_COLLISION | DNS_INFO_NO_RECORDS |
DNS_ERROR_NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1
DNS_ERROR_NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1 identifies the opposite invalid combination to the related NSEC3 error: the zone is configured for NSEC while one of its signing keys uses the RSA/SHA-1 (NSEC3) algorithm.
What to check
- Review both the authenticated-denial-of-existence setting and every KSK/ZSK algorithm.
- Select a compatible NSEC/NSEC3 and algorithm combination before changing the signed zone.
- Use the DNSSEC validation cmdlet to catch the configuration mismatch before it affects answers from the authoritative server.
Test-DnsServerDnsSecZoneSetting -ZoneName "example.com"Microsoft: Sign DNS zones with DNSSEC
Microsoft: Test-DnsServerDnsSecZoneSetting
Microsoft: Add-DnsServerSigningKey
Looking for a different code? Search another status or error code.