Troubleshoot an issue with DNSSEC not signing main domain zone, The Signing operation failed. Reason: 87 - The Parameter is incorrect.

Question

Hello,

I am having an issue signing my primary domain zone in DNS to enable DNSSEC. All other zones signed without any issues, but this zone (the most important one) is failing to sign every time.

The error I receive is:

The Signing operation failed. Reason: 87 - The Parameter is incorrect.

This is very vague, and i cannot find anything via searches to get a hint of where to go. sfc /scannow was ran, and so was DISM /online /cleanup-image \restorehealth. Three other zones signed with the same parameters (default) with no issues.

any direction?

Answer 1

QHello there,

This issue occurs because the DNS server cannot resolve the Canonical Name (CNAME) records in signed zones

Performing a clean boot will start Windows with the minimal set of drivers and startup programs. This procedure will help us figure out if the issue is caused by some sort of software conflict .

You can use tools like procmom to dig more.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file

system, Registry and process/thread activity. You can get the tool from here

https://docs.microsoft.com/enus/sysinternals/downloads/procmon

System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log

system activity to the Windows event log.You can get the tool from here

https://docs.microsoft.com/enus/sysinternals/downloads/sysmon

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--