What does Windows error code 9116 (DNS_ERROR_ROLLOVER_IN_PROGRESS) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The requested DNSSEC signing key is already participating in a rollover.

Previous	Next
DNS_ERROR_INVALID_INITIAL_ROLLOVER_OFFSET	DNS_ERROR_STANDBY_KEY_NOT_PRESENT

DNS_ERROR_ROLLOVER_IN_PROGRESS

DNS_ERROR_ROLLOVER_IN_PROGRESS means a key rollover is already underway for the selected DNSSEC signing key. Starting a second operation on the same key could create an inconsistent lifecycle.

Record the current key state and wait for the active rollover stage to complete or fail explicitly. Starting another transition can make diagnosis harder because parental updates and signing publication have ordered dependencies.

What to check

Inspect the current KSK or ZSK status and determine the phase of the existing rollover.
Wait for the scheduled transition and its required propagation time unless the documented recovery procedure calls for intervention.
Do not queue another rollover or delete the current key while it is active.

Get-DnsServerSigningKey -ZoneName "example.com"

Microsoft: Sign DNS zones with DNSSEC

Microsoft: DNSSEC Key Master

Microsoft: Test-DnsServerDnsSecZoneSetting

Looking for a different code? Search another status or error code.