Running your own DNS server gives you names like app.corp.example that resolve only inside your network, full control over records, and the foundation for Active Directory. It also adds a service you must patch, monitor, and get right. This guide covers when to run your own DNS, how to install the role, and how to configure zones, forwarders, and conditional forwarders — with both GUI and PowerShell steps.
When You Should NOT Run Your Own DNS
Running DNS is not always the right call. If you only need public records for a website, your domain registrar’s or hosting provider’s DNS panel is simpler and more reliable than a server you must keep patched. Run your own DNS when you need internal hostnames that must never be public, split-horizon resolution, or Active Directory integration. For a single application server, provider DNS is almost always the better default.
Before You Start: Static IP and a Plan
- Give the server a static IP address; DNS clients point at it, so it must not change.
- Decide the zone name: use a subdomain you control (for example
corp.example.com) rather than a made-up TLD. - Decide how the server resolves names outside its zones: forwarders (below) or root hints.
Install the DNS Role
In Server Manager, click Add Roles and Features, select DNS Server, and complete the wizard. PowerShell is faster:
Install-WindowsFeature DNS -IncludeManagementTools
Get-Service DNSThe service name is DNS and the management console is dnsmgmt.msc.
Create a Forward Lookup Zone
In DNS Manager, right-click Forward Lookup Zones and choose New Zone. Select Primary zone, give it a name, and accept the default zone file. On a domain controller you can also store the zone in AD DS with secure dynamic updates.
Add-DnsServerPrimaryZone -Name "corp.example.com" -ZoneFile "corp.example.com.dns"Add Records
| Record type | Purpose | Example |
|---|---|---|
| A | Host name to IPv4 | app → 10.0.0.5 |
| AAAA | Host name to IPv6 | app → 2001:db8::5 |
| CNAME | Alias to another name | www → web.corp.example.com |
| MX | Mail routing | priority 10 → mail.corp.example.com |
| TXT | Verification, SPF, DKIM | v=spf1 include:... |
Add-DnsServerResourceRecordA -Name "app" -ZoneName "corp.example.com" -IPv4Address "10.0.0.5"
Add-DnsServerResourceRecordCName -Name "www" -HostNameAlias "web.corp.example.com" -ZoneName "corp.example.com"Configure Forwarders
Forwarders are the upstream resolvers your DNS server uses for names outside its zones. Point them at a public resolver your provider permits, or at your provider’s own resolvers:
Set-DnsServerForwarder -IPAddress 1.1.1.1, 8.8.8.8GUI path: server Properties > Forwarders tab > Edit. If you leave forwarders empty, the server falls back to root hints. For an internal-only resolver, disable recursion on the interface that faces the internet and keep forwarders restricted to your internal network.
Conditional Forwarders for Internal Domains
A conditional forwarder sends queries for one specific domain to a specific server — ideal when you have a second office, a partner domain, or a VPN-connected site that runs its own DNS:
Add-DnsServerConditionalForwarderZone -Name "partner.corp" -MasterServers 10.0.1.10GUI path: Conditional Forwarders > New Conditional Forwarder. Queries for partner.corp go to 10.0.1.10; everything else uses the normal forwarders.
Secondary Zones and Zone Transfers
Resilience means a second DNS server. Create a secondary zone on another Windows Server and allow zone transfers from the primary:
Add-DnsServerSecondaryZone -Name "corp.example.com" -ZoneFile "corp.example.com.dns" -MasterServers 10.0.0.2On the primary zone’s Zone Transfers tab, allow transfers only to the secondary server’s IP — never “to any server”. DNS clients should then list both servers as preferred and alternate DNS, so name resolution survives a server or network failure.
Point Clients at the DNS Server
- Set the DNS server on each client’s NIC (IPv4 properties > Use the following DNS server addresses).
- Or set scope option 006 DNS Servers on your DHCP server so clients pick it up automatically.
- On clients, run
ipconfig /flushdnsandipconfig /registerdnsafter changing settings.
Verify and Troubleshoot
Resolve-DnsName app.corp.example.com
Resolve-DnsName corp.example.com -Type MX
nslookup app.corp.example.com 10.0.0.2The last command queries a specific server (10.0.0.2) directly — the fastest way to isolate a client-configuration problem from a server problem. If lookups fail only for external names, check the forwarders; if they fail only for internal names, check zone transfers and dynamic updates. For high-security zones, consider signing with DNSSEC and monitor the DNS server event log under DNS Server > Audit.
- External names fail while internal names work: check the forwarders and outbound UDP port 53 through the firewall.
- Internal names fail on clients but resolve on the server: check client DNS settings and DHCP option 006, and confirm the server’s firewall allows inbound DNS (UDP and TCP 53).
- Changes do not appear: check dynamic update settings and record TTLs; force a refresh with
dnscmd /zonerefreshor wait out the TTL. - The server resolves nothing at all: confirm the DNS service is running and that the server’s own NIC points at a valid resolver for its own lookups.
DNS is a small service, but it must run on a box you can reach when the network misbehaves. Review the Windows Server configurations in our feature overview and compare Windows server plans on our comparison table to pick a machine with enough memory for DNS plus your other workloads.
Compare Windows server plans for a second instance to run a secondary DNS server.
