Windows DNS server in depth: zones, records and forwarders

Start DC01, DC02 and CL01 (with 8 GB of memory, start DC01 and CL01, and DC02 only for step 5). Sign in to DC01 as SAATLAB\Administrator and open PowerShell as administrator. The DnsServer module is already installed on DCs.

1See the zones promotion created

On DC01, run this:

Get-DnsServerZone | Select-Object ZoneName, ZoneType, IsDsIntegrated, IsReverseLookupZone

You should see something like this:

ZoneName                ZoneType IsDsIntegrated IsReverseLookupZone
--------                -------- -------------- -------------------
_msdcs.saatlab.internal Primary  True           False
0.in-addr.arpa          Primary  False          True
127.in-addr.arpa        Primary  False          True
255.in-addr.arpa        Primary  False          True
saatlab.internal        Primary  True           False
TrustAnchors            Primary  True           False

saatlab.internal holds your domain’s records and _msdcs.saatlab.internal holds the forest-wide DC records. Both are AD-integrated. The three small reverse zones are built in and stop pointless queries for addresses like 127.0.0.1 leaving your network.

✅ Checkpoint: Both saatlab zones show IsDsIntegrated True. There is no reverse zone for 10.0.0.x yet.

2List the A records

On DC01, run this:

Get-DnsServerResourceRecord -ZoneName saatlab.internal -RRType A |
    Select-Object HostName, @{n='IP';e={$_.RecordData.IPv4Address}}, Timestamp

You should see something like this:

HostName       IP         Timestamp
--------       --         ---------
@              10.0.0.10  19/10/2026 15:00:00
@              10.0.0.11  19/10/2026 16:00:00
CL01           10.0.0.100 19/10/2026 16:00:00
DC01           10.0.0.10
DC02           10.0.0.11
DomainDnsZones 10.0.0.10  19/10/2026 15:00:00
DomainDnsZones 10.0.0.11  19/10/2026 16:00:00
ForestDnsZones 10.0.0.10  19/10/2026 15:00:00
ForestDnsZones 10.0.0.11  19/10/2026 16:00:00
SRV01          10.0.0.20  19/10/2026 16:00:00

Records with a timestamp were registered dynamically and can age. Records with an empty timestamp are static. @ means the zone name itself, so saatlab.internal resolves to both DCs.

✅ Checkpoint: You can see SRV01, CL01, DC01 and DC02 with the addresses from your lab plan.

3Add a reverse lookup zone

On DC01, run this:

Add-DnsServerPrimaryZone -NetworkId '10.0.0.0/24' -ReplicationScope Domain -DynamicUpdate Secure
Get-DnsServerZone 0.0.10.in-addr.arpa | Select-Object ZoneName, IsDsIntegrated, DynamicUpdate

You should see something like this:

ZoneName            IsDsIntegrated DynamicUpdate
--------            -------------- -------------
0.0.10.in-addr.arpa True           Secure

Reverse zone names are the network part written backwards. Computers add their own PTR records the next time they register, so speed it up on SRV01 and CL01 with ipconfig /registerdns, and on DC01 too.

Wait a minute, then on DC01 run this:

Resolve-DnsName 10.0.0.20 | Select-Object Name, NameHost

You should see something like this:

Name                    NameHost
----                    --------
20.0.0.10.in-addr.arpa  SRV01.saatlab.internal

✅ Checkpoint: 10.0.0.20 resolves back to SRV01.saatlab.internal.

4Create an A record and a CNAME

The intranet site you’ll build in Lesson 25 runs on SRV01, and people should reach shares with a name that doesn’t change when servers do. Create both:

On DC01, run this:

Add-DnsServerResourceRecordA -ZoneName saatlab.internal -Name intranet -IPv4Address 10.0.0.20
Add-DnsServerResourceRecordCName -ZoneName saatlab.internal -Name files -HostNameAlias SRV01.saatlab.internal
Resolve-DnsName files.saatlab.internal | Select-Object Name, Type, NameHost, IPAddress

You should see something like this:

Name                   Type  NameHost               IPAddress
----                   ----  --------               ---------
files.saatlab.internal CNAME SRV01.saatlab.internal
SRV01.saatlab.internal A                            10.0.0.20

The CNAME answer comes with the A record of its target in one reply. When SRV01 is replaced, you change one CNAME and every shortcut and mapped drive using files keeps working.

✅ Checkpoint: files.saatlab.internal resolves through a CNAME to 10.0.0.20.

5Check DC02: records replicate, forwarders don’t

Start DC02 if it isn’t running. On DC01, run this:

Get-DnsServerResourceRecord -ZoneName saatlab.internal -Name intranet -ComputerName DC02 | Select-Object HostName, RecordType
Get-DnsServerForwarder -ComputerName DC01 | Select-Object IPAddress
Get-DnsServerForwarder -ComputerName DC02 | Select-Object IPAddress

You should see something like this:

HostName RecordType
-------- ----------
intranet A

IPAddress
---------
{1.1.1.1}

IPAddress
---------
{}

The record you made on DC01 is on DC02 because the zone lives in AD. Forwarders live in each server’s own settings, so DC02’s list may be empty or different. If DC02 shows no forwarder, add it so both DCs answer internet names the same way:

On DC01, run this:

Add-DnsServerForwarder -IPAddress 1.1.1.1 -ComputerName DC02
Resolve-DnsName www.microsoft.com -Server 10.0.0.11 -Type A | Select-Object -First 1 Name, Type

✅ Checkpoint: DC02 has the intranet record and 1.1.1.1 as its forwarder, and it resolves www.microsoft.com.

6Turn on aging and scavenging

Laptops come and go, and their old records stay behind unless something cleans them up. Turn on aging for the zone, and scavenging on one DC only (DC01), so you know where cleanup happens:

On DC01, run this:

Set-DnsServerZoneAging -Name saatlab.internal -Aging $true -NoRefreshInterval 7.00:00:00 -RefreshInterval 7.00:00:00
Set-DnsServerScavenging -ScavengingState $true -ScavengingInterval 7.00:00:00
Get-DnsServerZoneAging -Name saatlab.internal | Select-Object ZoneName, AgingEnabled, NoRefreshInterval, RefreshInterval

You should see something like this:

ZoneName         AgingEnabled NoRefreshInterval RefreshInterval
--------         ------------ ----------------- ---------------
saatlab.internal True         7.00:00:00        7.00:00:00

A dynamic record that hasn’t been refreshed for 14 days (no-refresh plus refresh) can now be removed. Active computers refresh their records every day, so only dead ones go. Static records like intranet are never touched.

✅ Checkpoint: Aging is True on saatlab.internal and scavenging is on for DC01.

7Troubleshoot a lookup the methodical way

When a name doesn’t resolve, work from the client outwards. On CL01, in PowerShell:

Run these one at a time:

Get-DnsClientServerAddress -InterfaceAlias Ethernet -AddressFamily IPv4 | Select-Object ServerAddresses
Get-Content C:\Windows\System32\drivers\etc\hosts | Select-String -NotMatch '^\s*#'
Resolve-DnsName intranet.saatlab.internal
Resolve-DnsName intranet.saatlab.internal -Server 10.0.0.11 -DnsOnly
nslookup intranet.saatlab.internal

In order: which DNS servers is the client using, is there a hosts file entry overriding DNS, what does normal resolution return, what does a specific DC return directly, and what does nslookup say. nslookup always asks the DNS server and ignores the hosts file and the client cache, which is why it sometimes disagrees with what applications see.

✅ Checkpoint: All three lookups return 10.0.0.20, and the hosts file has no active entries.