What does Windows error code 9108 (DNS_ERROR_KSP_DOES_NOT_SUPPORT_PROTECTION) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: DNS_ERROR_KSP_DOES_NOT_SUPPORT_PROTECTION means the selected key storage provider lacks the data protection required for DNSSEC signing.

Previous	Next
DNS_ERROR_SIGNING_KEY_NOT_ACCESSIBLE	DNS_ERROR_UNEXPECTED_DATA_PROTECTION_ERROR

DNS_ERROR_KSP_DOES_NOT_SUPPORT_PROTECTION

DNS_ERROR_KSP_DOES_NOT_SUPPORT_PROTECTION means the selected CNG Key Storage Provider (KSP) cannot provide the data-protection capability required by Windows DNS Server for the signing key.

Confirm the provider selected for the signing key and its protection capabilities before generating replacement keys. Moving to a compatible provider is preferable to weakening protection requirements around a provider that cannot meet them.

What to check

Identify the KSP backing the signing key and verify that it is supported for DNS Server DNSSEC use on this host.
Check whether a provider change, HSM configuration, or migration introduced the key.
Generate a replacement key with a compatible provider only after planning its rollover and delegation impact.

Get-DnsServerSigningKey -ZoneName "example.com"

Microsoft: Sign DNS zones with DNSSEC

Microsoft: Add-DnsServerSigningKey

Microsoft: DNSSEC Key Master

Looking for a different code? Search another status or error code.