What does Windows error code 9987 (DNS_ERROR_POLICY_SCOPE_NOT_ALLOWED) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The DNS policy supplied scope information for an action that does not accept a scope.

Previous	Next
DNS_ERROR_POLICY_SCOPE_MISSING	DNS_ERROR_SERVERSCOPE_IS_REFERENCED

DNS_ERROR_POLICY_SCOPE_NOT_ALLOWED

DNS_ERROR_POLICY_SCOPE_NOT_ALLOWED means a policy includes scope information even though the selected action does not use a scope. This is a configuration mismatch rather than a missing DNS record.

What to verify

Review the policy action first; different actions accept different policy components.
Remove only the incompatible scope argument, not unrelated policy criteria.
Compare the command with the official cmdlet syntax for the exact policy type being created.

Get-DnsServerQueryResolutionPolicy
Get-DnsServerQueryResolutionPolicy -ZoneName "example.com"
Get-DnsServerClientSubnet

Microsoft: Add-DnsServerQueryResolutionPolicy

Microsoft: DNS Policies overview

Microsoft: Get-DnsServerQueryResolutionPolicy

Looking for a different code? Search another status or error code.