What does Windows error code 9622 (DNS_ERROR_ZONE_LOCKED_FOR_SIGNING) mean?

 
Previous Next
DNS_ERROR_ZONE_IS_SHUTDOWN DNS_ERROR_PRIMARY_REQUIRES_DATAFILE

DNS_ERROR_ZONE_LOCKED_FOR_SIGNING

DNSSEC signing currently owns the zone update state

Signing a zone is more than adding one record. DNSSEC introduces DNSKEY, RRSIG, DS, and authenticated denial-of-existence data, and the signer must produce consistent signatures over RRsets. Windows DNS exposes a zone-sign operation and can perform online signing for directory-integrated zones. A conflicting management change can be blocked while the signing pass is active.

Inspect the signing operation and zone DNSSEC state, then allow the current signing pass to finish before retrying the unrelated change. Do not immediately unsign the zone or delete signing keys to clear the lock; those actions alter the DNSSEC trust and rollover design. If the lock persists, investigate signing-key accessibility and DNS Server events rather than repeatedly submitting writes.

What to inspect

  • Check whether a zone-sign or signing-key operation was started recently.
  • Review DNS Server events for signing progress or key errors.
  • Retry the management change only after the signing state is stable and the zone lock has cleared.

References

Looking for a different code? Search another status or error code.