Windows error 9571 (DNS_ERROR_DELEGATION

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The DNS operation requires delegated credentials from its current security context.

Previous	Next
DNS_ERROR_NOT_ALLOWED_UNDER_DNAME	DNS_ERROR_INVALID_POLICY_TABLE

DNS_ERROR_DELEGATION_REQUIRED

This is credential delegation, not DNS namespace delegation

DNS_ERROR_DELEGATION_REQUIRED states that the operation needs credentials delegation. The word “delegation” here concerns authentication across a second security hop; it is different from delegating a child DNS zone with NS records. A process that can authenticate to an intermediate service may still be unable to let that service act toward a remote DNS server on the user’s behalf.

The exact operation that raised the code must be identified before changing Kerberos policy. Unconstrained or overly broad delegation creates significant security exposure. Prefer the narrow delegation mechanism supported by the environment and verify the service identities involved.

What to inspect

Map the client, intermediary, and target DNS server involved in the operation, including their service accounts and SPNs.
Confirm whether the call runs under impersonation and whether the current token is delegatable.
Check Kerberos tickets and constrained/resource-based delegation configuration rather than changing DNS records.
Test with a direct administration path to distinguish a second-hop authentication problem from DNS server authorization.

References

Looking for a different code? Search another status or error code.