What does Windows error code 9996 (DNS_ERROR_POLICY_INVALID_CRITERIA_TIME_OF_DAY) mean?

DNS_ERROR_POLICY_INVALID_CRITERIA_TIME_OF_DAY

DNS_ERROR_POLICY_INVALID_CRITERIA_TIME_OF_DAY means the time-window condition in the DNS policy is not valid. Time-based routing or filtering depends on a precisely formatted, unambiguous time range.

Check the server-local interpretation and format of the configured window, including start/end ordering. Test the policy with a narrow known interval before relying on a complex schedule for production query routing.

What to verify

• Review the time-of-day criterion syntax and verify the server clock, time zone, and time synchronization.
• Check boundaries that cross midnight and make the intended behavior explicit.
• Test immediately before and after the intended time window, not only during a single successful query.

Get-DnsServerQueryResolutionPolicy
Get-DnsServerQueryResolutionPolicy -ZoneName "example.com"
Get-DnsServerClientSubnet

Microsoft: Add-DnsServerQueryResolutionPolicy

Microsoft: DNS Policies overview

Microsoft: Get-DnsServerQueryResolutionPolicy