| Previous | Next |
| DNS_ERROR_NOT_ALLOWED_ON_ROOT_SERVER | DNS_ERROR_CANNOT_FIND_ROOT_HINTS |
DNS_ERROR_NOT_ALLOWED_UNDER_DELEGATION
The target name is below a DNS delegation point
A DNS delegation cuts the namespace into separate zones. The parent zone retains the child NS RRset and any required glue, but authoritative data below the delegated child is served from that child zone. RFC 1034 describes zones as authority units separated by delegation points; creating ordinary parent-zone data beneath such a cut conflicts with that model.
Inspect the closest ancestor NS RRset and identify which zone is authoritative for the requested owner name. The fix is normally to update the delegated child zone on one of its writable authoritative servers, not to force the record into the parent. Also distinguish glue addresses for delegated name servers from unrelated A or AAAA records below the delegation.
What to inspect
- Find the longest matching hosted zone for the requested FQDN.
- Inspect the parent zone for an NS delegation at the child boundary.
- Send the record update to the writable authority for the child zone and preserve only required delegation data in the parent.
References
- IETF RFC 1034: DNS namespace, zones, authority, and delegation
- Microsoft: Windows DNS architecture and authoritative data
- Microsoft: Get-DnsServerResourceRecord
Looking for a different code? Search another status or error code.