In this hands‑on lab, we’ll deploy a fully functional DNS server on Windows Server and integrate it with Active Directory. By the end, you’ll have:

• A Windows Server with the DNS role installed
• An Active Directory‑integrated forward lookup zone for your domain
• Properly configured forwarders and root hints
• Secure dynamic updates enabled
• DNS scavenging configured to keep your zone clean

We’ll use both the GUI (DNS Manager) and PowerShell to complete each step – giving you full flexibility.

We’ll assume the following lab setup:

• Domain: corp.lab
• DNS Server: DNS01.corp.lab (IP: 10.10.10.96)
• Domain Controller: DC01.corp.lab (IP: 10.10.10.94) – DNS role may already be installed
• Client: CLIENT01.corp.lab for testing

If you’re building from scratch, promote your DNS server to a domain controller first, or install DNS as a standalone server (for this lab, we’ll install it on a DC for AD integration).

Lab topology – DNS01 server in corp.lab domain

3.1 Using Server Manager (GUI)

1. Open Server Manager → Manage → Add Roles and Features.
2. Select Role-based or feature-based installation.
3. Select your server (e.g., DNS01).
4. Check DNS Server and click Next.
5. Click Install and wait for completion.

Server Manager – Adding DNS Server role

3.2 Using PowerShell (Faster)

# Install DNS Server role with management tools
Install-WindowsFeature -Name DNS -IncludeManagementTools

PowerShell – Installing DNS role

An AD‑integrated zone stores DNS data in the Active Directory database, providing multi‑master replication and secure updates.

4.1 Using DNS Manager (GUI)

1. Open DNS Manager (dnsmgmt.msc).
2. Right‑click Forward Lookup Zones → New Zone.
3. Select Primary Zone, check Store the zone in Active Directory.
4. Choose replication scope: To all DNS servers in this domain (recommended).
5. Enter zone name: corp.lab.
6. Select Allow only secure dynamic updates (AD‑authenticated).
7. Complete the wizard.

DNS Manager – New AD‑integrated zone

4.2 Using PowerShell

# Create AD-integrated primary zone with secure updates
Add-DnsServerPrimaryZone -Name "corp.lab" -ReplicationScope Domain -DynamicUpdate Secure

After creation, you’ll see the zone in DNS Manager. The Start of Authority (SOA) and Name Server (NS) records are automatically created.

Zone transfers allow secondary DNS servers to get a copy of the zone. For security, restrict transfers to specific servers.

5.1 Configure Zone Transfers (GUI)

1. In DNS Manager, right‑click the corp.lab zone → Properties.
2. Go to the Zone Transfers tab.
3. Check Allow zone transfers.
4. Select Only to the following servers and add your secondary DNS server’s IP.

Zone Transfers – Allow to specific servers

5.2 Create a Secondary Zone (On Another Server)

If you have a second DNS server, you can create a secondary zone:

# On the secondary DNS server
Add-DnsServerSecondaryZone -Name "corp.lab" -ZoneFile "corp.lab.dns" -MasterServers 10.10.10.96

Forwarders tell your DNS server where to send queries it can’t resolve (e.g., internet domains). Without forwarders, it uses root hints.

6.1 Using DNS Manager (GUI)

1. In DNS Manager, right‑click the server name → Properties.
2. Go to the Forwarders tab.
3. Click Edit and add your ISP’s DNS or a public resolver (e.g., 8.8.8.8, 1.1.1.1).

DNS Forwarders – Adding external resolvers

6.2 Using PowerShell

# Add forwarders
Set-DnsServerForwarder -IPAddress "8.8.8.8", "1.1.1.1" -PassThru

# Verify forwarders
Get-DnsServerForwarder

Root hints contain the IP addresses of the root name servers. If forwarders are not configured, the DNS server uses root hints for iterative resolution.

7.1 Verify Root Hints

# View current root hints
Get-DnsServerRootHint

# Update root hints from Microsoft (if needed)
Update-DnsServerRootHint -NameServer "a.root-servers.net" -IPAddress "198.41.0.4"

Root Hints – Default configuration

For most environments, default root hints work perfectly. Only modify them if you have specific requirements (e.g., internal root servers).

Scavenging automatically removes stale DNS records (e.g., old client registrations). Without it, your zone becomes cluttered with outdated entries.

8.1 Enable Scavenging on the Zone

1. In DNS Manager, right‑click the corp.lab zone → Properties.
2. Go to the General tab.
3. Click Aging → Check Scavenge stale resource records.
4. Set No‑refresh interval and Refresh interval (default: 7 days each).

DNS Scavenging – Aging configuration

8.2 Enable Scavenging on the Server

# Enable scavenging for the entire server
Set-DnsServerScavenging -ScavengingState $true -RefreshInterval 7.00:00:00 -NoRefreshInterval 7.00:00:00

# Start scavenging immediately (optional)
Start-DnsServerScavenging -Force

Now let’s verify that everything is working correctly.

9.1 Test Local Resolution

# Test local hostname
Resolve-DnsName -Name DNS01.corp.lab

# Test AD SRV records
Resolve-DnsName -Name _ldap._tcp.dc._msdcs.corp.lab -Type SRV

# Test external resolution (via forwarders)
Resolve-DnsName -Name google.com

9.2 Test from a Client

On a domain‑joined client, ensure the DNS server’s IP is set as the primary DNS:

# Check client's DNS configuration
ipconfig /all | findstr DNS

# Test resolution from client
nslookup DNS01.corp.lab

DNS resolution test – Client querying DNS01

9.3 Run DNS Best Practices Analyzer

# Run DNS BPA scan (GUI: Server Manager → DNS → Best Practices Analyzer)
Get-DnsServerDiagnostics -All

Let’s add some records to make our zone functional.

10.1 Create A and CNAME Records

# Add an A record for a web server
Add-DnsServerResourceRecordA -ZoneName "corp.lab" -Name "www" -IPv4Address "10.10.10.100"

# Add a CNAME alias (mail → mailserver)
Add-DnsServerResourceRecordCName -ZoneName "corp.lab" -Name "mail" -HostNameAlias "mailserver.corp.lab"

# Add an MX record for email
Add-DnsServerResourceRecordMX -ZoneName "corp.lab" -Name "@" -MailExchange "mailserver.corp.lab" -Preference 10

10.2 Add a Reverse Lookup Zone

Reverse lookup zones allow IP‑to‑hostname resolution (PTR records).

# Create reverse lookup zone for the 10.10.10.x subnet
Add-DnsServerPrimaryZone -Name "10.10.10.in-addr.arpa" -ReplicationScope Domain -DynamicUpdate Secure

# Add a PTR record for DNS01
Add-DnsServerResourceRecordPtr -ZoneName "10.10.10.in-addr.arpa" -Name "96" -PtrDomainName "DNS01.corp.lab"

DNS Manager – Reverse lookup zone with PTR records

When you create an AD‑integrated zone, the DNS data is stored in the Active Directory database (specifically in the DomainDnsZones and ForestDnsZones partitions).

• DomainDnsZones – Contains DNS data that replicates to all domain controllers in the domain.
• ForestDnsZones – Contains DNS data that replicates to all domain controllers in the forest (used for _msdcs and other forest‑wide records).

This provides:

• Multi‑master replication – Any DC can accept updates.
• Secure updates – Only authenticated AD users can modify records.
• Integration with AD replication – DNS changes replicate alongside AD changes.

• DNS Server not responding? – Check the service status: Get-Service DNS. Restart with Restart-Service DNS.
• Forwarders not working? – Test connectivity to the forwarder IP: Test-NetConnection 8.8.8.8 -Port 53.
• Zone not replicating? – Ensure the zone is AD‑integrated and replication scope is correct. Use repadmin /replsum to check AD replication health.
• Scavenging not removing records? – Records must be stale (not refreshed for the no‑refresh + refresh period). Use Get-DnsServerResourceRecordScavenging to check timestamps.

If you need to revert DNS changes or remove a zone, follow these steps.

13.1 Remove a Zone

# Remove a forward lookup zone
Remove-DnsServerZone -Name "corp.lab" -Force

# Remove a reverse lookup zone
Remove-DnsServerZone -Name "10.10.10.in-addr.arpa" -Force

13.2 Reset Forwarders to Default

# Remove all forwarders (reverts to root hints)
Set-DnsServerForwarder -IPAddress $null -PassThru

13.3 Uninstall the DNS Role

# Remove the DNS Server role
Uninstall-WindowsFeature -Name DNS -IncludeManagementTools