How to Set Up DNS on Windows Server

Before you begin: prerequisites

A DNS server quickly becomes core network infrastructure, so get the basics right first:

• A supported Windows Server installation (Standard or Datacenter). A trial or evaluation build is fine for a lab.
• A static IP address. A DNS server must never use a DHCP-assigned address — clients are configured to trust it at a fixed IP. Set a fixed IPv4 address, subnet mask and gateway first.
• An account in the local Administrators group (or Domain Admins on a domain controller).
• A plan for your namespace. Decide the zone name you will host, such as example.com or an internal name like corp.example.com. Prefer a domain you actually control; avoid bare single-label names.

Step 1 — Install the DNS Server role

You can do this with the graphical Server Manager or with one line of PowerShell. Installing the role does not require a reboot — Microsoft's Install and Configure DNS Server on Windows Server quickstart states the same for both the Install-WindowsFeature -Name DNS route and the Server Manager route.

Using Server Manager

1. Open Server Manager and choose Manage → Add Roles and Features.
2. Click through Before You Begin, keep Role-based or feature-based installation, and select your local server.
3. On the Server Roles page, tick DNS Server. When the pop-up offers to add the required management tools, click Add Features.
4. Click Next through the Features and DNS Server information pages, then on the confirmation page click Install. When it finishes, click Close.

Using PowerShell

Open an elevated PowerShell window and run:

Install-WindowsFeature -Name DNS -IncludeManagementTools

This installs the DNS Server role together with the DNS Manager console and the DNS PowerShell module.

Step 2 — Open DNS Manager

All zone and record work happens in the DNS Manager console. Open it from Server Manager → Tools → DNS, or run dnsmgmt.msc from the Start menu or Run box. In the left pane, expand your server name and you will see the Forward Lookup Zones and Reverse Lookup Zones folders.

Step 3 — Create a forward lookup zone

A forward lookup zone is the most common zone type: it resolves names to IP addresses and holds the bulk of your records. Create one for the namespace you want this server to be authoritative for.

1. In DNS Manager, right-click Forward Lookup Zones and choose New Zone… to launch the New Zone Wizard, then click Next.
2. On Zone Type, select Primary zone. (If this server is a domain controller, the Store the zone in Active Directory checkbox is available and recommended; on a standalone server it is greyed out and the zone is stored as a file.) Click Next.
3. Enter the Zone name, for example example.com, and click Next.
4. For a file-backed zone, accept the default zone file name (example.com.dns) and click Next.
5. On Dynamic Update, choose Do not allow dynamic updates for a simple static setup, or Allow only secure dynamic updates for an Active Directory-integrated zone. Click Next, review the summary, and click Finish.

The PowerShell equivalent creates the same primary zone in one line — the file-backed and Active Directory-integrated forms are both shown in the Add-DnsServerPrimaryZone cmdlet reference on Microsoft Learn:

Add-DnsServerPrimaryZone -Name "example.com" -ZoneFile "example.com.dns"

On a domain controller you would instead store it in the directory:

Add-DnsServerPrimaryZone -Name "example.com" -ReplicationScope "Domain"

Step 4 — Create a reverse lookup zone

A reverse zone maps IP addresses back to names using PTR records under the special in-addr.arpa namespace. It is optional, but mail servers, logging systems and diagnostics like nslookup and ping -a expect it to exist.

1. Right-click Reverse Lookup Zones and choose New Zone…, then Next.
2. Select Primary zone and click Next.
3. Choose IPv4 Reverse Lookup Zone (or IPv6 if applicable) and click Next.
4. Enter the Network ID — the network portion of your subnet, for example 10.0.0 for the 10.0.0.0/24 range. The wizard fills in the zone name for you (0.0.10.in-addr.arpa). Click Next.
5. Accept the default zone file, choose your dynamic-update setting as before, and click Finish.

The PowerShell equivalent uses the network in CIDR form. Microsoft documents the -NetworkId parameter as taking A.B.C.D/prefix for IPv4, and notes that a prefix falling between classes is rounded to the longer prefix divisible by 8:

Add-DnsServerPrimaryZone -NetworkID "10.0.0.0/24" -ZoneFile "0.0.10.in-addr.arpa.dns"

Step 5 — Add records (A, PTR, CNAME)

With your zones in place, populate them. The three records you will use most often are A (host name to IPv4 address), PTR (the reverse pointer), and CNAME (an alias that points one name at another).

Add an A (host) record

1. In DNS Manager, right-click your forward zone (for example example.com) and choose New Host (A or AAAA)….
2. Enter the Name (just the host label, such as server1 — the zone suffix is added for you) and the IP address.
3. Tick Create associated pointer (PTR) record if you built a reverse zone, then click Add Host.

Add-DnsServerResourceRecordA -ZoneName "example.com" -Name "server1" -IPv4Address "10.0.0.10" -CreatePtr

Add a PTR record manually

If you need a pointer that was not created automatically, add it in the reverse zone. The record Name is the host portion of the IP address:

Add-DnsServerResourceRecordPtr -ZoneName "0.0.10.in-addr.arpa" -Name "10" -PtrDomainName "server1.example.com"

Add a CNAME (alias) record

Use a CNAME to give a host a friendly second name — for example pointing intranet.example.com at server1.example.com. In DNS Manager, right-click the forward zone and choose New Alias (CNAME)…, enter the alias name and the target host's fully qualified name.

Add-DnsServerResourceRecordCName -ZoneName "example.com" -Name "intranet" -HostNameAlias "server1.example.com"

Step 6 — Configure forwarders

Your DNS server is authoritative for its own zones, but it also needs to resolve everything else on the internet. When it cannot answer from a hosted zone or its cache, it either forwards the query to servers you nominate (forwarders) or falls back to the built-in root hints. Forwarders are usually faster and easier to control.

1. In DNS Manager, right-click your server name and choose Properties.
2. Switch to the Forwarders tab and click Edit….
3. Enter the IP address of each upstream resolver — your ISP's DNS servers, or a public resolver such as 1.1.1.1 or 8.8.8.8 — pressing Enter after each. Windows validates each one.
4. Leave Use root hints if no forwarders are available ticked, then click OK twice.

The PowerShell equivalent sets both forwarders at once:

Set-DnsServerForwarder -IPAddress "1.1.1.1","8.8.8.8"

Root hints — the list of the internet's root name servers — are populated automatically on a fresh install, so you rarely touch them. They are used only when no forwarder answers; Microsoft's DNS Server quickstart puts it plainly: root hints aren't used unless your forwarders fail to respond, and they are populated by default in new installations.

How DNS underpins Active Directory

If you run a Windows domain, DNS is the foundation everything else stands on. Active Directory clients do not find domain controllers by IP address — they look them up. When a machine logs on, joins the domain, or applies Group Policy, it queries DNS for special service (SRV) records that advertise which servers offer domain services and where. Those records live under names like _ldap._tcp.dc._msdcs.example.com in an Active Directory-integrated zone that the domain controller creates and keeps current via secure dynamic updates.

Two consequences follow, and they cause the majority of "the domain won't work" support calls:

• Every domain-joined machine — including the domain controllers themselves — must use a domain controller running DNS as its preferred DNS server. Pointing a client at your router or a public resolver breaks logon and Group Policy, because those resolvers do not host the SRV records.
• Put public resolvers on the server as forwarders, not on the clients. The DNS server answers internal names itself and forwards only external queries upstream, so clients get both internal and internet resolution from one trusted source.

This is why the Active Directory promotion wizard installs DNS for you by default when you create a new forest — the two are designed to work as a pair. For the full walkthrough, see how to set up Active Directory on Windows Server.

Frequently asked

Do I need to install DNS separately if I am setting up Active Directory?

Usually not. When you promote a server to a domain controller and create a new forest, the Active Directory Domain Services configuration wizard offers to install and configure a DNS server on that domain controller for you, and it creates an Active Directory-integrated zone for your domain automatically. You only install the DNS Server role by hand when you want a standalone DNS server that is not tied to a domain promotion, or when you are adding DNS to an existing server.

What is the difference between a forward and a reverse lookup zone?

A forward lookup zone answers the common question: given a name like server1.example.com, what is its IP address? It is the zone that holds your A, CNAME and most other records. A reverse lookup zone does the opposite: given an IP address, what name owns it? It stores PTR records and lives under the special in-addr.arpa namespace. Forward zones are required for normal name resolution; reverse zones are optional but expected by mail servers, logging tools and diagnostics such as nslookup and ping -a.

Should I point clients at a public DNS server like 8.8.8.8 instead?

Not on a domain. Every domain-joined machine, including the domain controllers themselves, must use a domain controller running DNS as its preferred DNS server, because Active Directory clients find domain controllers by looking up special DNS records. Configure public resolvers such as 8.8.8.8 or 1.1.1.1 as forwarders on your DNS server instead, so the server handles internal names itself and only forwards internet lookups upstream. Pointing clients directly at a public resolver is the single most common reason a domain stops working.

What are forwarders and root hints?

When your DNS server receives a query it cannot answer from its own zones or cache, it needs somewhere to send it. Forwarders are specific upstream DNS servers, such as your ISP's resolvers or a public resolver, that you nominate to resolve those external queries. Root hints are a built-in list of the internet's root name servers that the DNS server falls back to when no forwarders are configured or when the forwarders fail to respond. New installations come with root hints populated, so forwarders are optional but usually faster and more predictable.