What does Windows error code 9125 (DNS_ERROR_DNSSEC_IS_DISABLED) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: DNS_ERROR_DNSSEC_IS_DISABLED this operation could not be completed because the DNS server has been configured with DNSSEC features disabled. Enable DNSSEC.

Previous	Next
DNS_ERROR_INVALID_NSEC3_ITERATION_COUNT	DNS_ERROR_INVALID_XML

DNS_ERROR_DNSSEC_IS_DISABLED

DNS_ERROR_DNSSEC_IS_DISABLED means the DNS server has DNSSEC functionality disabled, so it cannot complete the requested signing or DNSSEC-management operation.

Confirm whether DNSSEC was intentionally disabled at the server or zone-management level before enabling it. If signing is expected, restore the supported DNSSEC configuration rather than retrying the same signing command unchanged.

What to check

Verify the DNS Server role and its DNSSEC configuration on the authoritative primary server.
Confirm that the operation is being executed against a server version and deployment configuration that supports the intended DNSSEC feature.
After enabling the required feature, validate zone settings before signing or changing keys.

Get-DnsServerZone -Name "example.com"

Microsoft: Sign DNS zones with DNSSEC

Microsoft: Validate DNSSEC responses

Microsoft: Test-DnsServerDnsSecZoneSetting

Looking for a different code? Search another status or error code.