| Previous | Next |
| DNS_ERROR_NOT_ALLOWED_ON_RODC | DNS_ERROR_DELEGATION_REQUIRED |
DNS_ERROR_NOT_ALLOWED_UNDER_DNAME
A DNAME record occludes the descendant namespace
DNAME redirects an entire subtree rather than a single owner name. RFC 6672 states that adding a DNAME occludes domain names below that owner: the descendant names remain part of zone data in some transfer contexts, but normal lookup follows the DNAME redirection. Creating new ordinary data underneath the DNAME would produce data that is hidden by the redirection model.
Locate the nearest ancestor DNAME and decide whether the subtree redirect is intentional. If the new records must be directly authoritative, the namespace design needs to change by removing or relocating the DNAME before adding descendants. Do not confuse DNAME with CNAME: CNAME aliases one owner name, while DNAME rewrites names below an owner.
What to inspect
- Walk from the target name toward the zone apex and inspect each ancestor for DNAME.
- Verify the intended target subtree of the DNAME before changing records.
- Choose between subtree redirection and direct descendant data; do not try to maintain both at the same branch.
References
- IETF RFC 6672: DNAME redirection and occluded descendants
- IETF RFC 1034: DNS namespace, zones, authority, and delegation
- Microsoft: Get-DnsServerResourceRecord
Looking for a different code? Search another status or error code.