Windows Server 2022 — DNS recursive queries timing out due to bad forwarders — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

External name resolution is slow or fails; apps report intermittent internet host lookup errors.

Environment & Reproduction

Windows Server 2022 build 20348 DNS servers using unreachable or overloaded forwarders.

Get-DnsServerForwarder
Resolve-DnsName microsoft.com -Server 127.0.0.1
Test-NetConnection 8.8.8.8 -Port 53

Root Cause Analysis

Forwarder list includes dead resolvers or firewall egress blocks UDP/TCP 53.

Quick Triage

Compare direct root hints recursion versus configured forwarders.

Clear-DnsServerCache -Force
Resolve-DnsName github.com -Server 
Get-WinEvent -LogName 'DNS Server' -MaxEvents 50 | Select Id,Message

Step-by-Step Diagnosis

Measure timeout behavior and packet path to forwarders.

tracert 1.1.1.1
Test-NetConnection 1.1.1.1 -Port 53
Get-DnsServerDiagnostics

Solution — Primary Fix

Replace bad forwarders and keep at least two healthy public or upstream resolvers.

Set-DnsServerForwarder -IPAddress 1.1.1.1,8.8.8.8 -UseRootHint $true
Clear-DnsServerCache -Force
Restart-Service DNS

Solution — Alternative Approaches

If policy requires internal recursion only, remove forwarders and use root hints with firewall exceptions.

Remove-DnsServerForwarder -IPAddress 10.10.10.10 -Force
Set-DnsServerRecursion -Enable $true
Get-DnsServerRootHint

Verification & Acceptance Criteria

Average lookup time drops and timeout events cease.

Measure-Command { Resolve-DnsName powershellgallery.com -Server  }
Get-WinEvent -LogName 'DNS Server' -MaxEvents 30

Rollback Plan

Restore previous forwarder list if required for split-horizon routing.

Set-DnsServerForwarder -IPAddress 10.10.10.10,10.10.10.11 -UseRootHint $false

Prevention & Hardening

Monitor forwarder latency and availability continuously.

Get-DnsServerStatistics
Test-NetConnection 1.1.1.1 -Port 53
Test-NetConnection 8.8.8.8 -Port 53

Related Errors & Cross-Refs

Can overlap with firewall egress policy mistakes and MTU path issues.

Related tutorial: View the step-by-step tutorial for Windows Server 2022.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn DNS forwarders and recursion behavior on Windows Server 2022.