Edit

Configure DNS forwarding in Windows Server

DNS forwarding sends queries that a DNS server can't resolve locally to other DNS servers. Server-level forwarders handle general unresolved queries, while conditional forwarders handle queries for specific DNS namespaces. Choosing the appropriate forwarding path helps ensure that queries reach the intended DNS servers and follow your required fallback policy.

This article describes how to configure and validate server-level or conditional DNS forwarding in Windows Server by using DNS Manager or PowerShell. It also describes how to validate DNS responses and restore the previous configuration.

Prerequisites

  • A Windows Server computer on which you installed and configured the DNS Server role to answer client queries.
  • An account that's a member of the DnsAdmins group, the local Administrators group on the DNS server, or an equivalent delegated role.
  • DNS Manager or the DnsServer PowerShell module on the computer that you use to manage the DNS server.
  • One or more stable IPv4 or IPv6 addresses for the upstream DNS servers. Use independently available servers when the design requires redundancy.
  • An upstream DNS server that accepts recursive queries from the source address of your DNS server, or that can answer queries for the namespace that you conditionally forward.
  • Network access from the DNS server to each forwarder over UDP port 53 and TCP port 53.
  • A known DNS name that each prospective forwarder can resolve.
  • A documented decision about whether server-level queries can fall back to root hints and whether a private conditional-forwarder namespace can use another recursive path.

Warning

A server-level forwarder can affect every query that the DNS server can't answer from its authoritative zones or cache. A conditional forwarder can redirect an entire namespace. Record the existing configuration, test each prospective forwarder, and confirm the intended fallback policy before you change a production DNS server.

Prepare the DNS server for DNS forwarding

Record the current configuration and test prospective forwarders from the DNS server that sends the queries. A test from an administrator workstation doesn't validate the DNS server's source address, network path, firewall access, or permission to query the forwarder. For more information about resolution paths and fallback, see DNS forwarding in Windows Server.

  1. On the DNS server, open an elevated PowerShell session.

  2. Record the current server-level forwarders, recursion settings, and conditional forwarders in your approved change record:

    Get-DnsServerForwarder
Get-DnsServerRecursion
Get-DnsServerZone |
    Where-Object ZoneType -eq "Forwarder" |
    Select-Object ZoneName, IsDsIntegrated, MasterServers, ForwarderTimeout

  3. For each prospective server-level forwarder, replace the sample name and address, and then test DNS over UDP and TCP:

    Resolve-DnsName -Name "www.contoso.com" -Server "10.0.0.10" -DnsOnly
Resolve-DnsName -Name "www.contoso.com" -Server "10.0.0.10" -DnsOnly -TcpOnly

  4. For each prospective conditional forwarder, replace the sample name and address with a known record in the target namespace and the address of a target DNS server:

    Resolve-DnsName -Name "server01.south.contoso.com" -Server "10.20.0.10" -DnsOnly
Resolve-DnsName -Name "server01.south.contoso.com" -Server "10.20.0.10" -DnsOnly -TcpOnly

  5. Confirm that both queries return a DNS response within an acceptable time. For a private namespace, test more than one known record when possible.

    Note

    A negative answer such as NXDOMAIN is a DNS response, not a connectivity failure. It means that the name doesn't exist according to that server's resolution path. Verify the name and authoritative data instead of assuming that the forwarder is unreachable.

Configure server-level forwarders

Server-level forwarders receive general unresolved queries that don't match a hosted zone, conditional forwarder, or delegation. Choose DNS Manager or PowerShell, and make the root-hint fallback choice explicit.

  1. Open DNS Manager (dnsmgmt.msc).

  2. In the console tree, open the shortcut menu for the DNS server, and then select Properties.

  3. Select the Forwarders tab, and then select Edit.

  4. Enter the IP address of each upstream DNS server. Put preferred addresses in the order you want.

  5. Select OK.

  6. On the Forwarders tab, select or clear Use root hints if no forwarders are available according to your fallback policy.

  7. Select OK to apply the configuration.

Configure multiple forwarders when the design requires independent availability. Keep the list short enough that the overall recursion timeout can reach the required servers.

Configure a conditional forwarder

A conditional forwarder sends queries for one DNS namespace to designated DNS servers. Choose whether to store it locally or in Active Directory Domain Services, and replicate it only to the DNS servers that require the configuration.

Important

A conditional forwarder can't have the same name as a primary, secondary, or stub zone that the DNS server hosts. When the DNS server hosts an authoritative parent zone, you can create a conditional forwarder for a child namespace only if the child name is at or below a delegation in the parent zone. If the zone already exists, don't remove it until you understand its role and protect its data. For resolution choices and safe migration boundaries, see Resolve a conditional forwarder zone conflict.

To create an Active Directory-integrated conditional forwarder, perform this procedure on a writable domain controller. A read-only domain controller (RODC) can't create it.

Warning

DNS Manager initially creates the conditional forwarder with recursion fallback allowed. For a private namespace that exists only on the designated target servers, fallback can send queries to unintended DNS servers and produce inconsistent results. If you must prevent fallback from the moment of creation, use the PowerShell method and omit -UseRecursion instead of relying only on a postcreation change. This setting controls DNS resolver behavior; don't treat it as a network security boundary.

  1. Open DNS Manager (dnsmgmt.msc).

  2. Expand the DNS server, and then select Conditional Forwarders.

  3. Open the shortcut menu for Conditional Forwarders, and then select New Conditional Forwarder.

  4. In DNS Domain, enter the namespace to forward, such as south.contoso.com.

  5. Enter the IP address of each target DNS server that can resolve the namespace.

  6. If the conditional forwarder should replicate, select Store this conditional forwarder in Active Directory, and then select the required replication scope.

  7. Select OK.

  8. On the DNS server, open an elevated PowerShell session and run one of the following commands to make the fallback policy explicit.

    To prevent recursion fallback after you create the conditional forwarder in DNS Manager, run:

    Set-DnsServerConditionalForwarderZone `
    -Name "south.contoso.com" `
    -UseRecursion $false `
    -PassThru

    To deliberately allow recursion fallback, run this command instead:

    Set-DnsServerConditionalForwarderZone `
    -Name "south.contoso.com" `
    -UseRecursion $true `
    -PassThru

  9. Verify the configured fallback policy:

    Get-DnsServerZone -Name "south.contoso.com" |
    Format-List ZoneName, ZoneType, UseRecursion

If DNS Manager can't immediately validate a server name, verify the IP address and repeat the direct Resolve-DnsName tests before you treat the server as unusable.

Validate DNS forwarding

Validate both the stored settings and DNS responses. Test through the local DNS server first, and then use a representative client. A successful response alone doesn't prove which upstream path the DNS server used.

  1. On the DNS server, review the server-level forwarder settings:

    Get-DnsServerForwarder |
    Format-List IPAddress, UseRootHint, Timeout, EnableReordering

  2. If you created a conditional forwarder, review its settings:

    Get-DnsServerZone -Name "south.contoso.com" |
    Format-List ZoneName, ZoneType, IsDsIntegrated, MasterServers, ForwarderTimeout, UseRecursion

  3. Replace the sample server address with the address of the Windows DNS server, and then query names through that server:

    Resolve-DnsName -Name "www.contoso.com" -Server "192.0.2.53" -DnsOnly
Resolve-DnsName -Name "server01.south.contoso.com" -Server "192.0.2.53" -DnsOnly

    If the DNS server might already have cached a result, use a valid name that you didn't query recently. Clear the DNS server cache only during an approved maintenance window and after you consider the temporary increase in upstream traffic.

  4. From a representative DNS client, query the Windows DNS server:

    Resolve-DnsName -Name "www.contoso.com" -Server "192.0.2.53" -DnsOnly

    Successful resolution from the client confirms that the client received a response from the Windows DNS server. It doesn't prove that the server used a forwarder because the response might come from an authoritative zone, the cache, or a fallback path. Repeating a name that you tested on the server might also use the newly populated cache. To prove that the server used the designated upstream path, use a controlled query for a known-valid name that isn't cached and capture traffic on the DNS server. For packet-capture guidance, see Troubleshoot DNS name resolution failures related to DNS forwarders.

Troubleshoot DNS forwarding validation failures

Change one setting at a time while you isolate a failure. Keep detailed timeout, ordering, delegation, and fallback explanations in the DNS forwarding conceptual guidance.

Confirm that the DNS Server service is running:

Get-Service -Name "DNS"

Query each forwarder in the configuration directly from the Windows DNS server over UDP and TCP:

Resolve-DnsName -Name "www.contoso.com" -Server "10.0.0.10" -DnsOnly
Resolve-DnsName -Name "www.contoso.com" -Server "10.0.0.10" -DnsOnly -TcpOnly

Review the forwarder, recursion, and conditional-forwarder settings:

Get-DnsServerForwarder
Get-DnsServerRecursion
Get-DnsServerZone | Where-Object ZoneType -eq "Forwarder"

Query the same name through the Windows DNS server:

Resolve-DnsName -Name "www.contoso.com" -Server "192.0.2.53" -DnsOnly

Use the following results to narrow the cause:

  • If an ordinary DNS query succeeds but -TcpOnly fails, verify TCP port 53 end to end.
  • If direct queries succeed but queries through the Windows DNS server fail, review recursion, root-hint fallback, hosted zones, conditional forwarders, delegations, DNS policies, and cached answers.
  • If the DNS server returns REFUSED, verify that the upstream server accepts recursive queries from this source and that no DNS policy denies the query.
  • If only some names in a namespace that uses conditional forwarding fail, query every target server for the same records and compare their authoritative data.
  • If the client query fails but the test on the DNS server succeeds, investigate the client configuration and the path between the client and the Windows DNS server.

If the cause remains unclear, see Troubleshoot DNS name resolution failures related to DNS forwarders for packet-capture guidance.

Roll back DNS forwarding

Use the server-level forwarder address list, root-hint fallback setting, and conditional-forwarder zone details that you recorded before the change. Replace the sample addresses and namespace in the following commands with those recorded values. Don't treat these examples as a substitute for an approved backup and recovery process.

If you appended server-level forwarders, remove only the addresses that you added:

Remove-DnsServerForwarder `
    -IPAddress @("10.0.0.10", "10.0.0.11") `
    -Force `
    -PassThru

If you replaced the server-level forwarder list, restore the previously recorded addresses:

Set-DnsServerForwarder `
    -IPAddress @("192.0.2.10", "192.0.2.11") `
    -PassThru

Restore the previously recorded root-hint fallback setting. This example restores an enabled setting:

Set-DnsServerForwarder -UseRootHint $true -PassThru

Before you remove a conditional forwarder, verify that the named zone is a forwarder:

Get-DnsServerZone -Name "south.contoso.com" |
    Format-List ZoneName, ZoneType, IsDsIntegrated, MasterServers

If ZoneType is Forwarder, remove the conditional forwarder:

Remove-DnsServerZone -Name "south.contoso.com" -Force -PassThru

Warning

Remove-DnsServerZone can remove any zone type. Verify that the zone is the intended conditional forwarder before you run the command. If it's Active Directory-integrated, the deletion replicates to other DNS servers in the selected replication scope.

Repeat the validation queries to confirm that resolution follows the restored path. For an Active Directory-integrated conditional forwarder, allow time for replication and verify the result on DNS servers in the replication scope.

Related content

  • Last updated on