What does Windows error code 9128 (DNS_ERROR_ROLLOVER_NOT_POKEABLE) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: DNS_ERROR_ROLLOVER_NOT_POKEABLE means the specified signing key is not waiting for parental DS update.

Previous	Next
DNS_ERROR_NO_VALID_TRUST_ANCHORS	DNS_ERROR_NSEC3_NAME_COLLISION

DNS_ERROR_ROLLOVER_NOT_POKEABLE

DNS_ERROR_ROLLOVER_NOT_POKEABLE means Windows DNS Server cannot send the requested rollover notification because the selected key is not waiting for the parental DS update stage.

Check the key lifecycle state and whether a parental DS update is actually pending. The notification is meaningful only at the stage that expects parent-zone action, so forcing it earlier does not advance rollover safely.

What to check

Inspect the key rollover state and verify that the key is in the expected phase.
Confirm that the operation is being performed for a KSK workflow that actually involves parent delegation data.
Do not retry the notification blindly; correct the schedule or wait for the current state transition.

Get-DnsServerSigningKey -ZoneName "example.com"

Microsoft: DNSSEC Key Master

Microsoft: Sign DNS zones with DNSSEC

Microsoft: Get-DnsServerDnsSecZoneSetting

Looking for a different code? Search another status or error code.