What does Windows error code 9121 (DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED_ZONE) mean?

DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED_ZONE

DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED_ZONE means the requested action applies only to a DNSSEC-signed zone. The zone has no active signing configuration for the operation to modify.

Verify that the command targets the intended zone and that the zone has active DNSSEC signing metadata. If signing was removed intentionally, skip the DNSSEC-only operation rather than reconstructing keys solely to satisfy the command.

What to check

• Confirm that the intended zone is the correct one and check its IsSigned state.
• If DNSSEC is required, sign the authoritative primary zone using a planned rollout rather than enabling isolated records manually.
• If the zone is intentionally unsigned, remove DNSSEC-specific actions from the automation or deployment workflow.

Get-DnsServerZone -Name "example.com"

Microsoft: Sign DNS zones with DNSSEC

Microsoft: Validate DNSSEC responses

Microsoft: Get-DnsServerDnsSecZoneSetting