{"id":604,"date":"2026-08-12T22:58:46","date_gmt":"2026-08-12T22:58:46","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=604"},"modified":"2026-08-12T22:58:46","modified_gmt":"2026-08-12T22:58:46","slug":"set-up-dns-role-windows-server-zones-forwarders","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/","title":{"rendered":"Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Running your own DNS server gives you names like <code>app.corp.example<\/code> that resolve only inside your network, full control over records, and the foundation for Active Directory. It also adds a service you must patch, monitor, and get right. This guide covers when to run your own DNS, how to install the role, and how to configure zones, forwarders, and conditional forwarders \u2014 with both GUI and PowerShell steps.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">When You Should NOT Run Your Own DNS<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Running DNS is not always the right call. If you only need public records for a website, your domain registrar&#8217;s or hosting provider&#8217;s DNS panel is simpler and more reliable than a server you must keep patched. Run your own DNS when you need internal hostnames that must never be public, split-horizon resolution, or Active Directory integration. For a single application server, provider DNS is almost always the better default.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Before You Start: Static IP and a Plan<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Give the server a static IP address; DNS clients point at it, so it must not change.<\/li>\n<li>Decide the zone name: use a subdomain you control (for example <code>corp.example.com<\/code>) rather than a made-up TLD.<\/li>\n<li>Decide how the server resolves names outside its zones: forwarders (below) or root hints.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Install the DNS Role<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In Server Manager, click Add Roles and Features, select DNS Server, and complete the wizard. PowerShell is faster:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Install-WindowsFeature DNS -IncludeManagementTools\nGet-Service DNS<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The service name is <code>DNS<\/code> and the management console is <code>dnsmgmt.msc<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Create a Forward Lookup Zone<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In DNS Manager, right-click Forward Lookup Zones and choose New Zone. Select Primary zone, give it a name, and accept the default zone file. On a domain controller you can also store the zone in AD DS with secure dynamic updates.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Add-DnsServerPrimaryZone -Name \"corp.example.com\" -ZoneFile \"corp.example.com.dns\"<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Add Records<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Record type<\/th><th>Purpose<\/th><th>Example<\/th><\/tr><\/thead><tbody><tr><td>A<\/td><td>Host name to IPv4<\/td><td><code>app<\/code> &rarr; 10.0.0.5<\/td><\/tr><tr><td>AAAA<\/td><td>Host name to IPv6<\/td><td><code>app<\/code> &rarr; 2001:db8::5<\/td><\/tr><tr><td>CNAME<\/td><td>Alias to another name<\/td><td><code>www<\/code> &rarr; <code>web.corp.example.com<\/code><\/td><\/tr><tr><td>MX<\/td><td>Mail routing<\/td><td>priority 10 &rarr; mail.corp.example.com<\/td><\/tr><tr><td>TXT<\/td><td>Verification, SPF, DKIM<\/td><td><code>v=spf1 include:...<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>Add-DnsServerResourceRecordA -Name \"app\" -ZoneName \"corp.example.com\" -IPv4Address \"10.0.0.5\"\nAdd-DnsServerResourceRecordCName -Name \"www\" -HostNameAlias \"web.corp.example.com\" -ZoneName \"corp.example.com\"<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Configure Forwarders<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Forwarders are the upstream resolvers your DNS server uses for names outside its zones. Point them at a public resolver your provider permits, or at your provider&#8217;s own resolvers:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Set-DnsServerForwarder -IPAddress 1.1.1.1, 8.8.8.8<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">GUI path: server Properties &gt; Forwarders tab &gt; Edit. If you leave forwarders empty, the server falls back to root hints. For an internal-only resolver, disable recursion on the interface that faces the internet and keep forwarders restricted to your internal network.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conditional Forwarders for Internal Domains<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A conditional forwarder sends queries for one specific domain to a specific server \u2014 ideal when you have a second office, a partner domain, or a VPN-connected site that runs its own DNS:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Add-DnsServerConditionalForwarderZone -Name \"partner.corp\" -MasterServers 10.0.1.10<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">GUI path: Conditional Forwarders &gt; New Conditional Forwarder. Queries for <code>partner.corp<\/code> go to 10.0.1.10; everything else uses the normal forwarders.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Secondary Zones and Zone Transfers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Resilience means a second DNS server. Create a secondary zone on another Windows Server and allow zone transfers from the primary:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Add-DnsServerSecondaryZone -Name \"corp.example.com\" -ZoneFile \"corp.example.com.dns\" -MasterServers 10.0.0.2<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">On the primary zone&#8217;s Zone Transfers tab, allow transfers only to the secondary server&#8217;s IP \u2014 never &#8220;to any server&#8221;. DNS clients should then list both servers as preferred and alternate DNS, so name resolution survives a server or network failure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Point Clients at the DNS Server<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set the DNS server on each client&#8217;s NIC (IPv4 properties &gt; Use the following DNS server addresses).<\/li>\n<li>Or set scope option 006 DNS Servers on your DHCP server so clients pick it up automatically.<\/li>\n<li>On clients, run <code>ipconfig \/flushdns<\/code> and <code>ipconfig \/registerdns<\/code> after changing settings.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Verify and Troubleshoot<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Resolve-DnsName app.corp.example.com\nResolve-DnsName corp.example.com -Type MX\nnslookup app.corp.example.com 10.0.0.2<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The last command queries a specific server (10.0.0.2) directly \u2014 the fastest way to isolate a client-configuration problem from a server problem. If lookups fail only for external names, check the forwarders; if they fail only for internal names, check zone transfers and dynamic updates. For high-security zones, consider signing with DNSSEC and monitor the DNS server event log under DNS Server &gt; Audit.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>External names fail while internal names work: check the forwarders and outbound UDP port 53 through the firewall.<\/li>\n<li>Internal names fail on clients but resolve on the server: check client DNS settings and DHCP option 006, and confirm the server&#8217;s firewall allows inbound DNS (UDP and TCP 53).<\/li>\n<li>Changes do not appear: check dynamic update settings and record TTLs; force a refresh with <code>dnscmd \/zonerefresh<\/code> or wait out the TTL.<\/li>\n<li>The server resolves nothing at all: confirm the DNS service is running and that the server&#8217;s own NIC points at a valid resolver for its own lookups.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">DNS is a small service, but it must run on a box you can reach when the network misbehaves. <a href=\"https:\/\/windows-vps.org\/#features\">Review the Windows Server configurations in our feature overview<\/a> and <a href=\"https:\/\/windows-vps.org\/#providers\">compare Windows server plans on our comparison table<\/a> to pick a machine with enough memory for DNS plus your other workloads.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/windows-vps.org\/#providers\" rel=\"noreferrer noopener sponsored\">Compare Windows server plans<\/a> for a second instance to run a secondary DNS server.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Running your own DNS server gives you names like app.corp.example that resolve only inside your network, full control over records, and the foundation for Active Directory. It also adds a service you must patch, monitor, and get right. This guide covers when to run your own DNS, how to install the role, and how to &#8230; <a title=\"Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders\" class=\"read-more\" href=\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\" aria-label=\"Read more about Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":1,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-604","post","type-post","status-publish","format-standard","hentry","category-tutorials-guides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders - Windows VPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders\" \/>\n<meta property=\"og:description\" content=\"Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders\" \/>\n<meta property=\"og:url\" content=\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\" \/>\n<meta property=\"og:site_name\" content=\"Windows VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-12T22:58:46+00:00\" \/>\n<meta name=\"author\" content=\"windows-vps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"windows-vps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\",\"url\":\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\",\"name\":\"Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders - Windows VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\"},\"datePublished\":\"2026-08-12T22:58:46+00:00\",\"author\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\"},\"breadcrumb\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/windows-vps.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\",\"url\":\"https:\/\/windows-vps.org\/blog\/\",\"name\":\"Windows VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/windows-vps.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\",\"name\":\"windows-vps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"caption\":\"windows-vps\"},\"sameAs\":[\"https:\/\/windows-vps.org\/blog\"],\"url\":\"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders - Windows VPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/","og_locale":"en_US","og_type":"article","og_title":"Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders","og_description":"Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders","og_url":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/","og_site_name":"Windows VPS Blog","article_published_time":"2026-08-12T22:58:46+00:00","author":"windows-vps","twitter_card":"summary_large_image","twitter_misc":{"Written by":"windows-vps","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/","url":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/","name":"Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders - Windows VPS Blog","isPartOf":{"@id":"https:\/\/windows-vps.org\/blog\/#website"},"datePublished":"2026-08-12T22:58:46+00:00","author":{"@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58"},"breadcrumb":{"@id":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/windows-vps.org\/blog\/set-up-dns-role-windows-server-zones-forwarders\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/windows-vps.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Set Up the DNS Role on Windows Server: Zones, Forwarders, and Conditional Forwarders"}]},{"@type":"WebSite","@id":"https:\/\/windows-vps.org\/blog\/#website","url":"https:\/\/windows-vps.org\/blog\/","name":"Windows VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/windows-vps.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58","name":"windows-vps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","caption":"windows-vps"},"sameAs":["https:\/\/windows-vps.org\/blog"],"url":"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/"}]}},"_links":{"self":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/comments?post=604"}],"version-history":[{"count":1,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/604\/revisions"}],"predecessor-version":[{"id":605,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/604\/revisions\/605"}],"wp:attachment":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media?parent=604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/categories?post=604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/tags?post=604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}