Manage DNS zones using DNS server in Windows Server
Article
Create primary, secondary, stub, and reverse DNS zones using the DNS server role in Windows Server.
This article also shows you how to configure zone transfer settings and perform zone delegation.
Prerequisites
Before you can manage DNS zone in Windows Server, you need to complete the following
prerequisites:
Here's how to create a forward look up zone using DNS Manager.
From the Windows desktop, open the Start menu, select Windows Administrative Tools > DNS.
In the console tree, connect to the DNS server you wish to manage, expand the DNS server, right-click, then select New Zone.
On the New Zone Wizard page, select Next.
On the Zone Type page, select Primary zone and ensure Store the zone in Active Directory
is checked. This option is available when the DNS server is also an AD DS domain controller.
On the Active Directory Zone Replication Scope page, choose one of the following options:
All DNS servers running on AD DS domain controllers in the forest.
All DNS servers running on AD DS domain in the domain.
All domain controllers in this domain (for Windows 2000 compatibility).
All domain controllers enrolled in a specific directory partition.
On the Forward or Reverse Lookup Zone page, select Forward lookup zone.
On the zone name page, specify the name of the DNS zone. For example, north.contoso.com
On the Dynamic Update page, choose one of the following options:
Allow only secure dynamic updates (recommended for Active Directory).
Allow both nonsecure and secure dynamic updates.
Do not allow dynamic updates.
Select Finish to complete the New Zone Wizard.
Create a file based primary zone
To create a file based primary zone, select the relevant method and follow the
steps.
Here's how to create a file based DNS zone using the
Add-DnsServerPrimaryZone PowerShell
command.
To add the file based DNS zone east.contoso.com using the file east.contoso.com.dns, run the
following command on a computer with the DNS server role installed:
Here's how to create a file base forward lookup zone using DNS Manager.
From the Windows desktop, open the Start menu, select Windows Administrative Tools > DNS.
In the console tree, expand a DNS server then right-click, then select New Zone.
On the New Zone Wizard page, select Next.
On the Zone Type page, select Primary zone and ensure Store the zone in Active Directoryisn't checked. This option is only available of the DNS server is also an AD DS domain
controller.
On the Forward or Reverse Lookup Zone page, select Forward lookup zone.
On the zone name page, specify the name of the DNS zone. For example, east.contoso.com.
On the Zone File page, you're provided with the option to specify a new file name, with the
default being the zone name with the .dns extension. For example, east.contoso.com.dns. You
can also use an existing zone file that has been copied to the %SystemRoot%\system32\dns folder
on the DNS server.
On the Dynamic Update page, choose one of the following options:
Allow both nonsecure and secure dynamic updates.
Do not allow dynamic updates.
Select Finish to complete the New Zone Wizard.
Create a secondary zone
To create a secondary zone, select the relevant method and follow the steps.
Add the secondary zone western.contoso.com using the zone file name south.contoso.dns and
using the primary zone server at IP address 172.23.90.124 use the following command:
Here's how to create a secondary look up zone using DNS Manager.
From the Windows desktop, open the Start menu, select Windows Administrative Tools > DNS.
In the console tree, expand a DNS server then right-click, then select New Zone.
On the New Zone Wizard page, select Next.
On the Zone Type page, select Secondary zone.
On the Zone Name page, specify the name of the secondary zone. The name of the zone must match
the name of the primary zone to replicate from. For example, south.contoso.com.
On the Master DNS Servers page, specify the IP addresses of one or more DNS servers that host
copies of the primary zone. You need to ensure that the primary zone allows transfers to the
DNS server hosting the secondary zone. For example, 172.23.90.124.
Select Finish on the Completing the New Zone Wizard.
Create a stub zone
To create a stub zone, select the relevant method and follow the steps.
Here's how to create a reverse look up zone using DNS Manager.
From the Windows desktop, open the Start menu, select Windows Administrative Tools > DNS.
In the console tree, expand a DNS server then right-click, then select New Zone.
On the New Zone Wizard page, select Next.
On the Zone Type page, select Primary zone and ensure Store the zone in Active Directory is
selected. This option is available if the DNS server is also an AD DS domain controller.
On the Active Directory Zone Replication Scope page, choose one of the following options:
All DNS servers running on AD DS domain controllers in the forest.
All DNS servers running on AD DS domain in the domain.
All domain controllers in this domain (for Windows 2000 compatibility).
All domain controllers enrolled in a specific directory partition.
On the Forward or Reverse Lookup Zone page, select Reverse lookup zone.
On the Reverse Lookup Zone Name page, choose either of the following options:
IPv4 Reverse Lookup Zone.
IPv6 Reverse Lookup Zone.
On the Network ID page, enter the network ID in the normal (not the reversed) order. For example,
for the IPv4 network 192.168.220.0/24 enter the network ID as 192.168.220. The in-addr.arpa
zone name is automatically appended.
On the Dynamic Update page, choose one of the following options:
Allow only secure dynamic updates (recommended for Active Directory).
Allow both nonsecure and secure dynamic updates.
Do not allow dynamic updates.
Select Finish to complete the New Zone Wizard.
Configure zone transfer settings
To configure the zone transfer settings for a primary DNS zone, select the relevant method and
follow the steps.
Here's how to create a zone delegation using DNS Manager.
From the Windows desktop, open the Start menu, select Windows Administrative Tools > DNS.
In the console tree, expand a DNS server, right-click the DNS zone to delegate, then select New
Delegation.
On the Delegated Domain Name page, enter the delegated domain name. For example, to delegate the
subdomain south.west.contoso.com, enter south. The fully qualified domain name (FQDN) name
is automatically be appended.
Select Add to specify the names and IP addresses of the DNS server to host the delegated
zone.
Enter either:
The FQDN of the DNS server that is authoritative for the delegated zone, then select
Resolve. Add other DNS servers if necessary, when validated select OK.
Or
Manually enter the IP address of the DNS server that is authoritative for the delegated
zone. Add other DNS servers if necessary, when validated select OK.
Select Finish to complete the New Delegation Wizard.
Next steps
Now that you've created a DNS zone, configured zone transfer settings and performed zone delegation,
here's other articles to consider.
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.