What does Windows error code 9991 (DNS_ERROR_POLICY_INVALID_CRITERIA_TRANSPORT_PROTOCOL) mean?

DNS_ERROR_POLICY_INVALID_CRITERIA_TRANSPORT_PROTOCOL

DNS_ERROR_POLICY_INVALID_CRITERIA_TRANSPORT_PROTOCOL means the UDP/TCP transport-protocol condition in the policy is not valid.

What to verify for DNS_ERROR_POLICY_INVALID_CRITERIA_TRANSPORT_PROTOCOL

• Use the transport-protocol criterion only where the policy design genuinely needs to distinguish UDP from TCP DNS queries.
• Check the criterion syntax and operator against the cmdlet documentation.
• Test both UDP and TCP resolution after changing the policy, because clients can fall back to TCP for large responses.

Get-DnsServerQueryResolutionPolicy
Get-DnsServerQueryResolutionPolicy -ZoneName "example.com"
Get-DnsServerClientSubnet

Microsoft: Add-DnsServerQueryResolutionPolicy

Microsoft: DNS Policies overview

Microsoft: Get-DnsServerQueryResolutionPolicy

Where the result is returned

This result is Win32 system error 9991 (0x00002707) from winerror.h. AllStat describes it as “The criterion transport protocol provided in the policy is invalid.”