What does Windows error code 9991 (DNS_ERROR_POLICY_INVALID_CRITERIA_TRANSPORT_PROTOCOL) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The DNS policy contains an invalid transport-protocol criterion.

Previous	Next
DNS_ERROR_POLICY_INVALID_CRITERIA_CLIENT_SUBNET	DNS_ERROR_POLICY_INVALID_CRITERIA_NETWORK_PROTOCOL

DNS_ERROR_POLICY_INVALID_CRITERIA_TRANSPORT_PROTOCOL

DNS_ERROR_POLICY_INVALID_CRITERIA_TRANSPORT_PROTOCOL means the UDP/TCP transport-protocol condition in the policy is not valid.

What to verify for DNS_ERROR_POLICY_INVALID_CRITERIA_TRANSPORT_PROTOCOL

Use the transport-protocol criterion only where the policy design genuinely needs to distinguish UDP from TCP DNS queries.
Check the criterion syntax and operator against the cmdlet documentation.
Test both UDP and TCP resolution after changing the policy, because clients can fall back to TCP for large responses.

Get-DnsServerQueryResolutionPolicy
Get-DnsServerQueryResolutionPolicy -ZoneName "example.com"
Get-DnsServerClientSubnet

Microsoft: Add-DnsServerQueryResolutionPolicy

Microsoft: DNS Policies overview

Microsoft: Get-DnsServerQueryResolutionPolicy

Where the result is returned

This result is Win32 system error 9991 (0x00002707) from winerror.h. AllStat describes it as “The criterion transport protocol provided in the policy is invalid.”. The code is useful only together with the API that failed, because multiple Windows components can reuse system-error values while imposing different retry and cleanup rules.

Diagnostic sequence

Call GetLastError immediately after the failing API and save this result, the function name, all relevant flags, and the target path, handle, service, device, account, or policy object.
Capture the component log that owns the dns / policy / criteria / transport / protocol operation and retain the original numeric value before a framework converts it to an HRESULT or exception.
compare preconditions with the API documentation and reproduce with a minimal request before changing system-wide configuration.

Retry this result only after the resource or state named in “The criterion transport protocol provided in the policy is invalid.” has changed. For invalid parameters, unsupported formats, missing objects, policy restrictions, and access failures, correct the input or configuration instead of immediately repeating the same call.

Looking for a different code? Search another status or error code.