| Previous | Next |
| DNS_ERROR_NOT_ALLOWED_UNDER_DNAME | DNS_ERROR_INVALID_POLICY_TABLE |
DNS_ERROR_DELEGATION_REQUIRED
This is credential delegation, not DNS namespace delegation
DNS_ERROR_DELEGATION_REQUIRED states that the operation needs credentials delegation. The word “delegation” here concerns authentication across a second security hop; it is different from delegating a child DNS zone with NS records. A process that can authenticate to an intermediate service may still be unable to let that service act toward a remote DNS server on the user’s behalf.
The exact operation that raised the code must be identified before changing Kerberos policy. Unconstrained or overly broad delegation creates significant security exposure. Prefer the narrow delegation mechanism supported by the environment and verify the service identities involved.
What to inspect
- Map the client, intermediary, and target DNS server involved in the operation, including their service accounts and SPNs.
- Confirm whether the call runs under impersonation and whether the current token is delegatable.
- Check Kerberos tickets and constrained/resource-based delegation configuration rather than changing DNS records.
- Test with a direct administration path to distinguish a second-hop authentication problem from DNS server authorization.
References
- Microsoft: DNS system error codes
- Microsoft: Kerberos constrained delegation overview
- RFC 3645: GSS-TSIG secure dynamic update
Looking for a different code? Search another status or error code.