Before we type a single command, let’s understand why DNS is the most critical service in any Microsoft environment.

Active Directory depends on DNS. Without DNS, domain controllers can’t be found, clients can’t authenticate, and Group Policy fails. The Domain Controller Locator process uses DNS SRV records to discover domain controllers, sites, and global catalog servers.

In fact, Microsoft recommends installing DNS before promoting a server to a domain controller. That’s how foundational it is.

The Domain Name System (DNS) translates human‑readable hostnames like mail.corp.lab into machine‑readable IP addresses like 10.10.10.95. But it does much more than that.

DNS is a distributed, hierarchical database that stores records about domains and hosts. It’s designed to be scalable, fault‑tolerant, and fast.

2.1 The Hierarchy

DNS is structured like an inverted tree:

• Root (. ) – The top of the hierarchy. Managed by 13 root name servers.
• Top-Level Domains (TLDs) – .com, .org, .net, .lab, .local, and country codes.
• Second-Level Domains – corp.lab, microsoft.com.
• Subdomains – mail.corp.lab, ads.corp.lab.

2.2 Authoritative vs. Recursive Servers

• Authoritative Server – Holds the definitive records for a specific zone (e.g., corp.lab). It answers queries with authority.
• Recursive Server – Acts as an “intermediary.” It queries authoritative servers on behalf of clients, caches results, and returns the answer.

In an Active Directory environment, domain controllers typically host authoritative DNS zones for the AD domain, and clients use them as their recursive resolvers.

Every DNS zone contains records. Here are the ones you’ll encounter most often – especially in an AD context.

Let’s trace what happens when a client tries to resolve mail.corp.lab.

1. Check Local Cache – The client checks its local DNS cache (from previous queries).
2. Check Hosts File – C:\Windows\System32\drivers\etc\hosts is checked before any network query.
3. Query the Configured DNS Server – The client sends a recursive query to its configured DNS resolver (usually a domain controller).
4. Recursive Resolution – The DNS server queries the root servers → TLD servers → authoritative servers to find the answer.
5. Caching and Response – The answer is cached and returned to the client.

Active Directory requires DNS to function. Here’s how they’re intertwined:

5.1 SRV Records – The AD Locator

When a client needs to find a domain controller, it queries DNS for SRV records:

# Find a domain controller for the domain corp.lab
nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.lab

# Output example:
_ldap._tcp.dc._msdcs.corp.lab SRV service location:
    priority = 0
    weight   = 100
    port     = 389
    svr hostname = dc01.corp.lab

The AD Locator process uses these records in sequence:

1. Site‑Aware Discovery – Queries _ldap._tcp.<sitename>._sites.dc._msdcs.<domain>
2. Domain‑Wide Discovery – Queries _ldap._tcp.dc._msdcs.<domain>
3. Global Catalog Discovery – Queries _gc._tcp.<domain>

5.2 AD‑Integrated Zones

When you install DNS on a domain controller, you can create Active Directory‑integrated zones. These zones store DNS data in the AD database (rather than a flat file). Benefits include:

• Multi‑master replication – Any DC can update the zone.
• Secure dynamic updates – Only authenticated AD users can update records.
• Simplified administration – No separate zone file management.

5.3 The _msdcs Zone

When you promote a server to a DC, a special _msdcs subdomain is created (e.g., _msdcs.corp.lab). This zone contains all the critical SRV records for AD, and it replicates with AD, ensuring every DC has the same view.

DNS Manager showing AD‑integrated zones and _msdcs subdomain

Let’s get hands‑on. Open PowerShell as Administrator on a domain‑joined machine and run these commands.

6.1 Resolve-DnsName (PowerShell)

# Simple hostname resolution
Resolve-DnsName -Name mail.corp.lab

# Query a specific record type
Resolve-DnsName -Name corp.lab -Type MX

# Query SRV records for AD
Resolve-DnsName -Name _ldap._tcp.dc._msdcs.corp.lab -Type SRV

# Query global catalog
Resolve-DnsName -Name _gc._tcp.corp.lab -Type SRV

PowerShell – Resolve-DnsName SRV query output

6.2 Using nslookup (Classic)

# Interactive mode
nslookup
> set type=SRV
> _ldap._tcp.dc._msdcs.corp.lab
> exit

# One‑liner
nslookup -type=SRV _kerberos._tcp.dc._msdcs.corp.lab

6.3 Viewing the DNS Cache

# View cached records
ipconfig /displaydns

# Flush the cache (when troubleshooting)
ipconfig /flushdns

Now let’s examine the SRV records that make AD work.

7.1 List All SRV Records for Your Domain

# Export all SRV records to a file
Get-DnsServerResourceRecord -ZoneName "corp.lab" -RRType SRV | Export-Csv -Path "C:\DNS-SRV-Records.csv" -NoTypeInformation

# View in PowerShell
Get-DnsServerResourceRecord -ZoneName "corp.lab" -RRType SRV | Where-Object { $_.RecordName -like "*_msdcs*" }

7.2 Verify DC Locator Records

Run these tests to confirm your AD DNS is healthy:

# Check if the DC can be found
nltest /dsgetdc:corp.lab

# Detailed DC locator query
nltest /dsgetdc:corp.lab /FORCE /NETBIOS

nltest /dsgetdc output showing DC discovery

7.3 Validate DNS Health with dcdiag

# Run the DNS test on all domain controllers
dcdiag /test:DNS /v

# Focus on registration issues
dcdiag /test:RegisterInDNS /v

A clean dcdiag /test:DNS is one of the best indicators that your AD DNS is healthy.

Here are the most frequent DNS problems in AD environments and how to fix them.

8.1 Client Can’t Find the Domain Controller

• Symptom: Nslookup _ldap._tcp.dc._msdcs.corp.lab returns “Non-existent domain”.
• Fix: Ensure the DC has registered its SRV records. Restart the Netlogon service (net stop netlogon && net start netlogon).

8.2 Stale or Duplicate Records

• Symptom: A host resolves to an old or wrong IP.
• Fix: Enable DNS scavenging to automatically remove stale records. Configure it on the zone properties in DNS Manager.

8.3 Secure Update Failures

• Symptom: Event ID 2505 in the DNS Server log – “The DNS server encountered a dynamic update that failed.”
• Fix: Ensure the client is authenticated (domain‑joined) and has permission to update its record. Check the zone’s security settings.

• DNS is the foundation of Active Directory – without it, AD doesn’t work.
• SRV records are the most critical records for AD – they enable clients to find domain controllers, GCs, and services.
• AD‑integrated zones provide multi‑master replication and secure updates.
• Tools like Resolve-DnsName, nslookup, and dcdiag are your best friends for troubleshooting.
• DNS scavenging is essential to keep your zone clean and prevent stale records.
• Understanding the resolution process helps you diagnose where failures occur.