| Previous | Next |
| DNS_ERROR_KSP_NOT_ACCESSIBLE | DNS_ERROR_INVALID_ROLLOVER_PERIOD |
DNS_ERROR_TOO_MANY_SKDS
DNS_ERROR_TOO_MANY_SKDS means Windows DNS Server cannot add another signing-key descriptor for the same algorithm and KSK/ZSK role. The existing rollover state must be reviewed before creating more keys.
List descriptors for the same algorithm and role and determine which belong to active, standby, or retired rollover stages. Clean up obsolete lifecycle state through supported management before trying to add another equivalent descriptor.
What to check
- List active, standby, revoked, and rolling-over keys for the zone.
- Check whether an earlier rollover was left incomplete or queued twice.
- Remove or retire keys only through the documented rollover lifecycle, after confirming that dependent DS and DNSKEY records are safe.
Get-DnsServerSigningKey -ZoneName "example.com"Microsoft: Add-DnsServerSigningKey
Looking for a different code? Search another status or error code.