How to configure RRL exceptions for outbound recursive forwarders via PowerShell?

Question

How do we configure RRL exceptions for outbound recursive forwarders via PowerShell?

Answer 1

Hello @Malzaar

There’s an important distinction here: Windows DNS Response Rate Limiting (RRL) applies to responses that your DNS server sends to clients, primarily to reduce DNS amplification abuse. It does not rate-limit the outbound recursive queries your DNS server sends to its configured forwarders.

So if by “RRL exceptions for outbound recursive forwarders” you mean exempting specific upstream forwarder IPs such as 8.8.8.8 or an internal recursive resolver, that isn’t how the RRL exception list is scoped.

Microsoft documents RRL exceptions as exemptions based on one or more of:

• queried FQDNs,
• client subnets that send queries to your DNS server,
• server interfaces receiving those queries.

For example, to exempt a trusted client subnet from RRL:

Add-DnsServerResponseRateLimitingExceptionlist `
    -Name "TrustedResolvers" `
    -ClientSubnet "EQ,10.20.30.0/24"

Or to exempt responses for a particular DNS name:

Add-DnsServerResponseRateLimitingExceptionlist `
    -Name "CriticalName" `
    -Fqdn "EQ,www.contoso.com"

You can review the configured exception lists with:

Get-DnsServerResponseRateLimitingExceptionlist

and inspect the global RRL configuration with:

Get-DnsServerResponseRateLimiting

Microsoft exposes separate recursion/forwarder configuration for outbound recursive resolution. Set-DnsServerRecursion controls recursion behavior, while forwarders are managed separately; RRL exceptions don’t control the DNS server’s traffic toward those upstream servers.

So if you’re troubleshooting failures or throttling between your Windows DNS server and its outbound forwarders, I’d look instead at forwarder configuration, recursion timeout, firewall/network behavior, or the upstream resolver’s own rate limits, not Windows DNS RRL. Microsoft also documents the forwarder/recursion timeout behavior separately.

Sharing these references with you:

Microsoft Learn – Add-DnsServerResponseRateLimitingExceptionlist, Set-DnsServerResponseRateLimiting, and Set-DnsServerRecursion.

Please "Accept the Answer" if this information helped you. This will help us and others in the community.