{"id":604,"date":"2026-08-12T22:58:46","date_gmt":"2026-08-12T22:58:46","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=604"},"modified":"2026-10-20T22:08:08","modified_gmt":"2026-10-20T22:08:08","slug":"set-up-dns-role-windows-server-zones-forwarders","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/","title":{"rendered":"Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes"},"content":{"rendered":"<div style=\"padding:20px\">\n<p>DNS is the foundation of an Active Directory domain: every logon, LDAP bind, Kerberos ticket request, Group Policy refresh, and SYSVOL lookup begins with an SRV or host (A) record query. When a DC&#8217;s DNS goes bad, users do not see &#8220;DNS error&#8221; \u2014 they see logon failures, GPO processing taking 20 minutes, and printers disappearing. This guide covers the specific checks and repairs that resolve AD-integrated DNS problems on Windows Server 2022\/2025, using dcdiag, Repadmin, DNSLint-style zone checks, and PowerShell DNS cmdlets. If you are standing up a fresh domain controller, the <a href=\"https:\/\/windows-vps.org\/\">Windows Server hosting configurations<\/a> we describe elsewhere include the static-IP and DNS-client settings you need before promotion.<\/p>\n<h2>Layer 1: The Domain Member&#8217;s DNS Client Configuration<\/h2>\n<p>Before touching the DNS server, prove the client resolves correctly. On every member server, the NIC must have exactly one or two DNS servers, both of which are domain controllers (or a DNS server that hosts an AD-integrated copy of the zone). The most common fault is a domain member whose DNS points at a public resolver such as 8.8.8.8 or 1.1.1.1 \u2014 SRV records for <code>_ldap._tcp.dc._msdcs.contoso.com<\/code> do not exist there.<\/p>\n<ul>\n<li>Run <code>ipconfig \/all<\/code> and confirm the DNS servers listed are DC IPs.<\/li>\n<li>Check that no third-party VPN client or &#8220;smart DNS&#8221; shim has overwritten the interface DNS list.<\/li>\n<li>Clear the cache with <code>ipconfig \/flushdns<\/code>, then <code>ipconfig \/registerdns<\/code>.<\/li>\n<\/ul>\n<p>From the member, resolve each of the following and confirm each returns a DC address, not a timeout:<\/p>\n<ul>\n<li><code>nslookup -type=SRV _ldap._tcp.dc._msdcs.contoso.com<\/code><\/li>\n<li><code>nslookup -type=SRV _kerberos._tcp.dc._msdcs.contoso.com<\/code><\/li>\n<li><code>nslookup -type=SRV _kpasswd._tcp.contoso.com<\/code><\/li>\n<li><code>nslookup -type=A dc01.contoso.com<\/code><\/li>\n<\/ul>\n<p>If those resolve but logon is still slow, the fault is not resolution but the ordering of the returned DC list, which is covered in layer 3.<\/p>\n<h2>Layer 2: dcdiag and the Replication Health of the Zone<\/h2>\n<p>In an AD-integrated zone, the DNS data is replicated through the same directory partition that carries the domain objects. If replication is broken, a DC will answer queries with stale or missing records \u2014 it holds the zone but not the current contents.<\/p>\n<p>Run on each DC, from an elevated prompt:<\/p>\n<ul>\n<li><code>dcdiag \/test:dns \/v \/e<\/code> \u2014 the verbose <code>DNS<\/code> test checks connectivity to the forwarder, AD-integrated zone presence, SRV record registration, and dynamic update capability for every DC in the enterprise. The summary section at the end lists <code>PASS\/FAIL\/WARN<\/code> per DC per category.<\/li>\n<li><code>dcdiag \/test:advertising<\/code> \u2014 confirms each DC is advertising itself in DNS for LDAP.<\/li>\n<li><code>repadmin \/replsummary<\/code> \u2014 shows largest delta and replication failures per DC pair.<\/li>\n<li><code>repadmin \/showrepl<\/code> \u2014 per-partition last replication success time.<\/li>\n<\/ul>\n<p>A common pattern: <code>dcdiag \/test:dns<\/code> reports &#8220;The DNS server did not record the SRV record&#8221; for a DC. That means netlogon registration failed. Fix it with:<\/p>\n<pre><code>net stop netlogon\nnet start netlogon\n\n# Force immediate reregistration of all records\nnltest \/dsregdns\nGet-DnsServerResourceRecord -ZoneName contoso.com | Measure-Object\n\n# Verify SRV records are back\nResolve-DnsName -Name _ldap._tcp.dc._msdcs.contoso.com -Type SRV\n<\/code><\/pre>\n<p>The reasons netlogon fails to register are narrow: the DC&#8217;s NIC is pointing at a public DNS server or at itself in a way that produces a loop, the zone is not AD-integrated on that DC, or the DC has been unable to reach a writable DC to put the record in.<\/p>\n<h2>Layer 3: Zone Contents, Scavenging, and Stale Records<\/h2>\n<p>Duplicate A records are a classic cause of intermittent LDAP failures. When a DC is re-imaged or has its IP changed, the old A record can persist because dynamic update created it with a timestamp, but scavenging is not enabled.<\/p>\n<ul>\n<li>In DNS Manager, open the zone, choose <em>Aging<\/em> from the context menu, and confirm scavenging is enabled on both the zone and the server (<code>Set-DnsServerScavenging<\/code>).<\/li>\n<li>Check <code>Get-DnsServerResourceRecord -ZoneName contoso.com -RRType A | Where-Object {$_.RecordData.IPv4Address -eq '10.0.0.15'}<\/code> to find duplicates.<\/li>\n<li>Never delete the records of a live DC without stopping it first; instead, deregister from the DC itself with <code>ipconfig \/release<\/code> + <code>\/renew<\/code> or <code>nltest \/dsregdns<\/code>.<\/li>\n<\/ul>\n<p>Duplicate PTR records in the reverse zone are less damaging but slow <code>nslookup<\/code> and some application logging. Enable scavenging on the reverse zone as well.<\/p>\n<h2>Layer 4: Forwarders, Conditional Forwarders, and Root Hints<\/h2>\n<p>AD-integrated zones resolve the domain; everything else is forwarded. Misconfigured forwarders produce the infamous &#8220;3-second delay&#8221; on every web request from a server, because the DNS client retries each server in the list serially.<\/p>\n<ul>\n<li><code>Get-DnsServerForwarder<\/code> \u2014 list the current forwarders. Use two or three public resolvers on different networks, or your ISP&#8217;s if the public ones are blocked.<\/li>\n<li><code>Get-DnsServerRootHint<\/code> and <code>Resolve-DnsName www.microsoft.com -Server 10.0.0.10<\/code> to time a forwarded query.<\/li>\n<li>Set the forwarder timeout and disable recursion correctly with <code>Set-DnsServerForwarder -TimeOut 3<\/code>.<\/li>\n<li>If the VPS provider filters outbound UDP\/53 to public resolvers (increasingly common), the domain still resolves but the internet does not. Test with <code>Test-NetConnection 8.8.8.8 -Port 53<\/code> and switch to the provider&#8217;s resolver or DNS over HTTPS via a local proxy if needed.<\/li>\n<\/ul>\n<pre><code># Time forwarded resolution from a client\nMeasure-Command { Resolve-DnsName www.microsoft.com -Server dc01.contoso.com }\n<\/code><\/pre>\n<p>Anything above 200 ms for a single uncached query indicates a forwarder path with loss or a slow first hop. Compare against a query served from cache, which should be under 2 ms.<\/p>\n<h2>Layer 5: Client-Side Symptoms Mapped to Causes<\/h2>\n<table>\n<thead>\n<tr>\n<th>Symptom<\/th>\n<th>Likely cause<\/th>\n<th>First command<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Logon takes 60\u2013120 s, then works<\/td>\n<td>Member pointing at wrong DNS or a DC not advertising<\/td>\n<td><code>dcdiag \/test:advertising \/v<\/code><\/td>\n<\/tr>\n<tr>\n<td>GPO not applying to some machines<\/td>\n<td>Stale\/duplicate A record for a DC<\/td>\n<td><code>Get-DnsServerResourceRecord<\/code><\/td>\n<\/tr>\n<tr>\n<td>Intermittent &#8220;no logon servers available&#8221;<\/td>\n<td>Replication delay between DCs<\/td>\n<td><code>repadmin \/replsummary<\/code><\/td>\n<\/tr>\n<tr>\n<td>Every external lookup takes ~3 s<\/td>\n<td>Dead forwarder in the list<\/td>\n<td><code>Get-DnsServerForwarder<\/code><\/td>\n<\/tr>\n<tr>\n<td>DNS event 4013 at boot<\/td>\n<td>Zone loaded before AD is reachable \u2014 check AD connectivity first<\/td>\n<td><code>dcdiag \/test:connectivity<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Prevention: What to Baseline<\/h2>\n<p>Record three values on a monthly cadence so a regression is visible the day it appears: the count of A\/SRV records per DC, the result of <code>dcdiag \/test:dns \/e<\/code>, and forwarded query latency. Store the output as a file or into a SQL table via a scheduled task. When a DC is re-IPed, re-imaged, or a new one is promoted, rerun all five layers rather than the most convenient one.<\/p>\n<p>If the domain is small \u2014 one or two DCs on a single host \u2014 the same checks apply, but you also need to keep the DNS service and the DC on separate uptime assumptions: a host reboot that brings the DC up before the network is routable will leave the zone unregistered until netlogon retries. A delayed start on the DNS service, or a scheduled <code>nltest \/dsregdns<\/code> a minute after boot, closes that gap on the <a href=\"https:\/\/windows-vps.org\/\">Windows Server environments<\/a> we document, where virtual NICs can take several seconds to appear.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>DNS is the foundation of an Active Directory domain: every logon, LDAP bind, Kerberos ticket request, Group Policy refresh, and SYSVOL lookup begins with an SRV or host (A) record query. When a DC&#8217;s DNS goes bad, users do not see &#8220;DNS error&#8221; \u2014 they see logon failures, GPO processing taking 20 minutes, and printers &#8230; <a title=\"Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes\" class=\"read-more\" href=\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\" aria-label=\"Read more about Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":3,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-604","post","type-post","status-publish","format-standard","hentry","category-tutorials-guides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes - Windows VPS Blog<\/title>\n<meta name=\"description\" content=\"DNS is the foundation of an Active Directory domain: every logon, LDAP bind, Kerberos ticket request, Group Policy refresh, and SYSVOL lookup begins with\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes\" \/>\n<meta property=\"og:description\" content=\"Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes\" \/>\n<meta property=\"og:url\" content=\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\" \/>\n<meta property=\"og:site_name\" content=\"Windows VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-12T22:58:46+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-20T22:08:08+00:00\" \/>\n<meta name=\"author\" content=\"windows-vps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@myxiechengxuan\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"windows-vps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\",\"url\":\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\",\"name\":\"Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes - Windows VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\"},\"datePublished\":\"2026-08-12T22:58:46+00:00\",\"dateModified\":\"2026-10-20T22:08:08+00:00\",\"author\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\"},\"description\":\"DNS is the foundation of an Active Directory domain: every logon, LDAP bind, Kerberos ticket request, Group Policy refresh, and SYSVOL lookup begins with\",\"breadcrumb\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/windows-vps.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\",\"url\":\"https:\/\/windows-vps.org\/blog\/\",\"name\":\"Windows VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/windows-vps.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\",\"name\":\"windows-vps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"caption\":\"windows-vps\"},\"sameAs\":[\"https:\/\/windows-vps.org\/blog\",\"https:\/\/x.com\/myxiechengxuan\"],\"url\":\"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes - Windows VPS Blog","description":"DNS is the foundation of an Active Directory domain: every logon, LDAP bind, Kerberos ticket request, Group Policy refresh, and SYSVOL lookup begins with","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/","og_locale":"en_US","og_type":"article","og_title":"Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes","og_description":"Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes","og_url":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/","og_site_name":"Windows VPS Blog","article_published_time":"2026-08-12T22:58:46+00:00","article_modified_time":"2026-10-20T22:08:08+00:00","author":"windows-vps","twitter_card":"summary_large_image","twitter_creator":"@myxiechengxuan","twitter_misc":{"Written by":"windows-vps","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/","url":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/","name":"Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes - Windows VPS Blog","isPartOf":{"@id":"https:\/\/windows-vps.org\/blog\/#website"},"datePublished":"2026-08-12T22:58:46+00:00","dateModified":"2026-10-20T22:08:08+00:00","author":{"@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58"},"description":"DNS is the foundation of an Active Directory domain: every logon, LDAP bind, Kerberos ticket request, Group Policy refresh, and SYSVOL lookup begins with","breadcrumb":{"@id":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/windows-vps.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Active Directory DNS Failures: dcdiag, SRV Records, Scavenging, and Forwarder Fixes"}]},{"@type":"WebSite","@id":"https:\/\/windows-vps.org\/blog\/#website","url":"https:\/\/windows-vps.org\/blog\/","name":"Windows VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/windows-vps.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58","name":"windows-vps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","caption":"windows-vps"},"sameAs":["https:\/\/windows-vps.org\/blog","https:\/\/x.com\/myxiechengxuan"],"url":"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/"}]}},"_links":{"self":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/comments?post=604"}],"version-history":[{"count":2,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/604\/revisions"}],"predecessor-version":[{"id":898,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/604\/revisions\/898"}],"wp:attachment":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media?parent=604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/categories?post=604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/tags?post=604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}