What does Windows error code 9111 (DNS_ERROR_UNKNOWN_SIGNING_PARAMETER_VERSION) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The DNS Server found signing-key metadata with an unknown parameter version.

Previous	Next
DNS_ERROR_UNEXPECTED_CNG_ERROR	DNS_ERROR_KSP_NOT_ACCESSIBLE

DNS_ERROR_UNKNOWN_SIGNING_PARAMETER_VERSION

DNS_ERROR_UNKNOWN_SIGNING_PARAMETER_VERSION means a signing key carries DNSSEC parameter metadata that this DNS Server cannot interpret. This can occur after an incompatible server or metadata migration.

Compare the server version and signing metadata origin before rewriting the zone. If the data came from migration, restore, or another DNS Server version, use a supported conversion or re-signing workflow rather than editing metadata directly.

What to check

Identify the server version and the source of the signing metadata.
Check whether the zone was restored, imported, or replicated from a server with a different DNSSEC feature level.
Use supported DNSSEC export/import and configuration cmdlets; do not edit serialized signing metadata.

Get-DnsServerDnsSecZoneSetting -ZoneName "example.com" -SigningMetaData

Microsoft: Get-DnsServerDnsSecZoneSetting

Microsoft: Sign DNS zones with DNSSEC

Microsoft: DNSSEC Key Master

Looking for a different code? Search another status or error code.