What does Windows error code 9117 (DNS_ERROR_STANDBY_KEY_NOT_PRESENT) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The requested DNSSEC key does not have a standby key available for the requested action.

Previous	Next
DNS_ERROR_ROLLOVER_IN_PROGRESS	DNS_ERROR_NOT_ALLOWED_ON_ZSK

DNS_ERROR_STANDBY_KEY_NOT_PRESENT

DNS_ERROR_STANDBY_KEY_NOT_PRESENT means the requested DNSSEC operation expects a standby replacement key, but no suitable standby key exists for the current KSK or ZSK.

Review the rollover design and key states to identify which role lacks a standby key. Generate or schedule the replacement through supported DNSSEC key-management commands rather than repurposing an active signing key.

What to check

Review signing keys for a compatible standby key with the required role and algorithm.
Confirm that an earlier key-generation or rollover preparation step did not fail.
Generate and stage a replacement only through the supported DNSSEC key workflow, then allow the required timing to pass.

Get-DnsServerSigningKey -ZoneName "example.com"

Microsoft: Add-DnsServerSigningKey

Microsoft: Sign DNS zones with DNSSEC

Microsoft: DNSSEC Key Master

Looking for a different code? Search another status or error code.