What does Windows error code 9106 (DNS_ERROR_INVALID_KEY_SIZE) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The requested DNSSEC key size is not supported for the selected signing algorithm.

Previous	Next
DNS_ERROR_UNSUPPORTED_ALGORITHM	DNS_ERROR_SIGNING_KEY_NOT_ACCESSIBLE

DNS_ERROR_INVALID_KEY_SIZE

DNS_ERROR_INVALID_KEY_SIZE means the requested key length is not valid for the selected DNSSEC signing algorithm. The algorithm and key size must be chosen as a supported pair.

Read the supported key-size range for the chosen algorithm from the DNS Server tooling on the target system. Reusing a size from another algorithm can fail even when both algorithms are otherwise supported for DNSSEC.

What to check

Review the intended algorithm and its supported key lengths in the DNS Server signing-key command documentation.
Check whether the error occurs while generating a KSK or a ZSK; do not assume that the same size is appropriate for both roles.
Validate the zone configuration after changing the key parameters.

Add-DnsServerSigningKey -ZoneName "example.com" -Type ZoneSigningKey

Microsoft: Add-DnsServerSigningKey

Microsoft: Sign DNS zones with DNSSEC

Microsoft: Test-DnsServerDnsSecZoneSetting

Looking for a different code? Search another status or error code.