How to Set Up DNS Server Role on Windows Server

Windows Server can function as a full DNS server — commonly deployed alongside Active Directory for internal name resolution, or standalone for general DNS hosting needs.

Step 1 — Install the DNS Server Role

Install-WindowsFeature -Name DNS -IncludeManagementTools

Step 2 — Open DNS Manager

dnsmgmt.msc

Or manage entirely via PowerShell, covered below.

Step 3 — Create a Forward Lookup Zone

Add-DnsServerPrimaryZone -Name "yourdomain.com" -ZoneFile "yourdomain.com.dns"

Step 4 — Add DNS Records

Add-DnsServerResourceRecordA -ZoneName "yourdomain.com" -Name "www" -IPv4Address "203.0.113.10"
Add-DnsServerResourceRecordCName -ZoneName "yourdomain.com" -Name "mail" -HostNameAlias "www.yourdomain.com"

Step 5 — Configure Forwarders (For Resolving External Domains)

Set-DnsServerForwarder -IPAddress "8.8.8.8","1.1.1.1"

Forwarders handle queries for domains your server isn't authoritative for, passing them to another (typically public) DNS server to resolve.

Step 6 — Allow DNS Through the Firewall

Enable-NetFirewallRule -DisplayGroup "DNS Service"

Creating a Reverse Lookup Zone

Add-DnsServerPrimaryZone -NetworkID "203.0.113.0/24" -ZoneFile "203.0.113.dns"
Add-DnsServerResourceRecordPtr -ZoneName "113.0.203.in-addr.arpa" -Name "10" -PtrDomainName "www.yourdomain.com"

Setting Up DNS for an Active Directory Environment

If installed alongside AD DS (see How to Install and Configure Active Directory Domain Services), the DNS role is often automatically configured with AD-integrated zones, providing tighter integration for domain name resolution than a standalone DNS setup.

Viewing Existing DNS Zones

Get-DnsServerZone

Viewing Records in a Zone

Get-DnsServerResourceRecord -ZoneName "yourdomain.com"

Setting Up DNSSEC (If Needed)

Add-DnsServerSigningKey -ZoneName "yourdomain.com" -Type KSK
Invoke-DnsServerZoneSign -ZoneName "yourdomain.com"

See DNSSEC concepts covered generally in How to Set Up DNSSEC for Your Domain — the underlying concepts are the same, though the Windows DNS Server implementation and commands differ from the BIND-based examples referenced there.

When to Use Windows DNS vs a Linux-Based DNS Solution

Windows DNS Server makes particular sense when tightly integrated with an existing Active Directory environment — for standalone DNS hosting without an AD dependency, a Linux-based DNS server (BIND) is equally valid and often more commonly documented/supported across broader hosting contexts.

Common Errors

External domains fail to resolve despite internal zones working — verify forwarders are correctly configured; without them, your DNS server can only resolve zones it's directly authoritative for.

Continue Reading

Browse more articles in Windows Server Administration.

  • windows dns server, windows server dns role, add-dnsserverzone, windows dns configuration
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

How to Connect to a Windows VPS via Remote Desktop (RDP)

Remote Desktop Protocol (RDP) provides full graphical access to a Windows Server VPS, letting you...

How to Secure RDP on a Windows VPS

RDP's default configuration (standard port, password authentication, unlimited login attempts)...

How to Create a New Administrator User on Windows Server

Using only the built-in Administrator account for all management tasks is risky. Creating a...

How to Install Windows Updates on a Windows VPS

Keeping Windows Server updated is essential for security and stability. This guide covers...

How to Configure Windows Firewall on a Windows VPS

Windows Defender Firewall controls which network connections are allowed to and from your server....