What does Windows error code 9129 (DNS_ERROR_NSEC3_NAME_COLLISION) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A collision occurred while generating NSEC3 hashed owner names for the signed zone.

Previous	Next
DNS_ERROR_ROLLOVER_NOT_POKEABLE	DNS_ERROR_NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1

DNS_ERROR_NSEC3_NAME_COLLISION

DNS_ERROR_NSEC3_NAME_COLLISION means Windows DNS Server detected a hash collision while building NSEC3 records for the zone. The zone cannot safely continue signing with the current NSEC3 salt and parameters.

Preserve the current NSEC3 parameters and the names involved before regenerating the chain. Changing the salt or other NSEC3 settings should be performed through supported zone-signing operations so the published chain remains consistent.

What to check

Review the NSEC3 salt and other configured parameters.
Use a newly generated salt or another supported NSEC/NSEC3 configuration, then validate the zone settings before signing again.
Do not manually delete generated denial-of-existence records as a workaround.

Test-DnsServerDnsSecZoneSetting -ZoneName "example.com"

Microsoft: Sign DNS zones with DNSSEC

Microsoft: Test-DnsServerDnsSecZoneSetting

Microsoft: Validate DNSSEC responses

Looking for a different code? Search another status or error code.