The DNS Server role turns Windows Server into a DNS server: it can host your own zones (authoritative DNS), resolve names for your internal network, and integrate with Active Directory. It’s essential for AD domains, and useful for internal networks. Here’s how to set it up and manage it, mostly with PowerShell.

Background: DNS records explained.

When to run DNS on Windows Server

  • Active Directory: domain controllers need DNS (AD-integrated zones).
  • Internal name resolution for a private network or VPN (app.corp.internal).
  • Authoritative DNS for public domains: possible, but most people use their registrar’s DNS or a DNS provider (with anycast and DDoS protection). If you do host public DNS, use at least two servers in different locations.

Install the role

Install-WindowsFeature DNS -IncludeManagementTools

The DNS Manager console (dnsmgmt.msc) is then available, along with the DnsServer PowerShell module.

Create a forward lookup zone

Add-DnsServerPrimaryZone -Name "corp.internal" -ZoneFile "corp.internal.dns" -DynamicUpdate None

On a domain controller, use an AD-integrated zone instead:

Add-DnsServerPrimaryZone -Name "corp.internal" -ReplicationScope "Domain" -DynamicUpdate Secure

Add records

Add-DnsServerResourceRecordA     -ZoneName "corp.internal" -Name "app"  -IPv4Address "10.0.0.20"
Add-DnsServerResourceRecordCName -ZoneName "corp.internal" -Name "www"  -HostNameAlias "app.corp.internal"
Add-DnsServerResourceRecordMX    -ZoneName "corp.internal" -Name "."    -MailExchange "mail.corp.internal" -Preference 10
Add-DnsServerResourceRecord      -ZoneName "corp.internal" -Name "."    -Txt -DescriptiveText "v=spf1 -all"

Get-DnsServerResourceRecord -ZoneName "corp.internal"
Remove-DnsServerResourceRecord -ZoneName "corp.internal" -Name "old" -RRType A -Force

Reverse lookup zones (PTR)

For private networks:

Add-DnsServerPrimaryZone -NetworkId "10.0.0.0/24" -ZoneFile "0.0.10.in-addr.arpa.dns"
Add-DnsServerResourceRecordPtr -ZoneName "0.0.10.in-addr.arpa" -Name "20" -PtrDomainName "app.corp.internal"

Public IP reverse DNS is controlled by whoever owns the IP block, so you can’t set it in your own Windows DNS server. On VPS.DO, PTR records for USA VPS IPs are set in the client area. See VPS IP addresses.

Forwarders (for recursive resolution)

Internal clients also need to resolve internet names. Configure forwarders to trusted resolvers:

Set-DnsServerForwarder -IPAddress "1.1.1.1","9.9.9.9" -UseRootHint $true

Security: don’t be an open resolver

A DNS server that answers recursive queries from anyone on the internet gets abused for DDoS amplification attacks. If the server has a public IP:

  • Allow DNS (53/udp and 53/tcp) in Windows Firewall only from your internal networks or VPN:
New-NetFirewallRule -DisplayName "DNS UDP internal" -Direction Inbound -Protocol UDP -LocalPort 53 -RemoteAddress 10.0.0.0/8 -Action Allow
New-NetFirewallRule -DisplayName "DNS TCP internal" -Direction Inbound -Protocol TCP -LocalPort 53 -RemoteAddress 10.0.0.0/8 -Action Allow
  • If it serves public authoritative zones, disable recursion: Set-DnsServerRecursion -Enable $false.
  • Restrict zone transfers to specific secondary servers only (zone properties → Zone Transfers).

See Windows Server firewall with PowerShell and VPS DDoS protection.

Conditional forwarders

When one internal domain is hosted on another DNS server (for example a partner network over VPN, or a second AD forest), add a conditional forwarder for just that domain:

Add-DnsServerConditionalForwarderZone -Name "partner.internal" -MasterServers 10.20.0.10

Queries for partner.internal go to 10.20.0.10. Everything else uses your normal forwarders.

Common problems

  • Clients still get old answers: caches. Clear the server cache, and the client cache, or wait for the TTL to expire.
  • AD clients can’t find domain controllers: clients must use the domain controllers as their DNS servers, not a public resolver.
  • External names don’t resolve: check the forwarders, and that outbound UDP/TCP 53 is allowed.

Testing

Resolve-DnsName app.corp.internal -Server 127.0.0.1
Resolve-DnsName example.com -Server 127.0.0.1
Get-DnsServerStatistics | Select-Object -ExpandProperty QueryStatistics

Clear the server cache after changes: Clear-DnsServerCache -Force. Clients: Clear-DnsClientCache.

Backups

AD-integrated zones are replicated and backed up with Active Directory (system state). File-based zones live in C:\Windows\System32\dns. Include that folder in backups, or export zones:

Export-DnsServerZone -Name "corp.internal" -FileName "corp.internal.backup.dns"

See Windows Server Backup.

Quick reference

Task Cmdlet
Install Install-WindowsFeature DNS
New zone Add-DnsServerPrimaryZone
A record Add-DnsServerResourceRecordA
Forwarders Set-DnsServerForwarder
Disable recursion Set-DnsServerRecursion -Enable $false
Test Resolve-DnsName name -Server 127.0.0.1

Related: DNS propagation and PowerShell basics.

  • Windows Server
  • DNS
  • PowerShell