What does Windows error code 9995 (DNS_ERROR_POLICY_INVALID_CRITERIA_QUERY_TYPE) mean?

DNS_ERROR_POLICY_INVALID_CRITERIA_QUERY_TYPE

DNS_ERROR_POLICY_INVALID_CRITERIA_QUERY_TYPE means the policy’s record-type condition is not valid. Query type distinguishes requests such as A, AAAA, MX, TXT, or other DNS RR types.

Use the DNS query type names or values accepted by the policy interface and verify each requested type. Record data present in the zone does not validate the query-type criterion used to select incoming requests.

What to verify

• Use a valid DNS record type that matches the actual query traffic you intend to filter or route.
• Check whether the desired behavior should apply to all query types instead of a single type.
• Test the policy using the exact query type after changing it; matching an A query does not imply matching AAAA or MX queries.

Get-DnsServerQueryResolutionPolicy
Get-DnsServerQueryResolutionPolicy -ZoneName "example.com"
Get-DnsServerClientSubnet

Microsoft: Add-DnsServerQueryResolutionPolicy

Microsoft: DNS Policies overview

Microsoft: Get-DnsServerQueryResolutionPolicy