| Previous | Next |
| DNS_ERROR_BAD_KEYMASTER | DNS_ERROR_INVALID_NSEC3_ITERATION_COUNT |
DNS_ERROR_INVALID_SIGNATURE_VALIDITY_PERIOD
DNS_ERROR_INVALID_SIGNATURE_VALIDITY_PERIOD means the requested validity interval for DNSSEC signatures is outside the acceptable range or is inconsistent with the signing configuration.
Compare the requested interval with the zone signing policy, current key lifecycle, and clock on the DNS server. Fix the validity configuration before forcing a resign so newly generated signatures do not inherit the same invalid timing.
What to check
- Review the signature validity and refresh timing together with the zone TTLs and key rollover schedule.
- Confirm the value is being set in the expected units and applies to the intended zone.
- Validate the complete zone-signing configuration before using the revised timing in production.
Test-DnsServerDnsSecZoneSetting -ZoneName "example.com"Microsoft: Sign DNS zones with DNSSEC
Looking for a different code? Search another status or error code.