| Previous | Next |
| DNS_ERROR_NO_VALID_TRUST_ANCHORS | DNS_ERROR_NSEC3_NAME_COLLISION |
DNS_ERROR_ROLLOVER_NOT_POKEABLE
DNS_ERROR_ROLLOVER_NOT_POKEABLE means Windows DNS Server cannot send the requested rollover notification because the selected key is not waiting for the parental DS update stage.
What to check
- Inspect the key rollover state and verify that the key is in the expected phase.
- Confirm that the operation is being performed for a KSK workflow that actually involves parent delegation data.
- Do not retry the notification blindly; correct the schedule or wait for the current state transition.
Get-DnsServerSigningKey -ZoneName "example.com"Microsoft: Sign DNS zones with DNSSEC
Microsoft: Get-DnsServerDnsSecZoneSetting
Looking for a different code? Search another status or error code.