How to Configure a DNS Server on Windows Server 2012 R2

May 3, 2026
Tutorials
Comment off

How to Configure a DNS Server on Windows Server 2012 R2

The Domain Name System (DNS) is the backbone of name resolution in Windows environments. Without properly configured DNS, Active Directory cannot function, client computers cannot find domain controllers, and users cannot resolve internal or external hostnames. Windows Server 2012 R2 includes the DNS Server role, which supports all standard DNS record types, DNSSEC signing, DNS-based Authentication of Named Entities (DANE), and full integration with Active Directory for dynamic, replicated zones.

This guide covers installing the DNS Server role, creating and managing forward and reverse lookup zones, configuring forwarders, setting up conditional forwarding, managing records, and verifying resolution — all through PowerShell and Server Manager.

Prerequisites

Windows Server 2012 R2 with a static IP address.
Local or Domain Administrator account.
For AD-integrated DNS: Active Directory must already be installed, or you can install DNS and AD DS simultaneously.
Know your organisation’s internal domain name and IP address schema.

Step 1: Install the DNS Server Role

# Install DNS Server role with management tools
Install-WindowsFeature -Name DNS -IncludeManagementTools

# Verify installation
Get-WindowsFeature -Name DNS | Select-Object Name, InstallState, DisplayName

# Confirm the DNS Server service is running
Get-Service -Name DNS | Select-Object Name, Status, StartType

After installation, the DNS Manager console is available under Server Manager → Tools → DNS. The DnsServer PowerShell module is also available.

Step 2: Create a Primary Forward Lookup Zone

A forward lookup zone resolves hostnames to IP addresses. For an Active Directory–integrated zone, the zone data is stored in the AD database and replicated automatically to all domain controllers running DNS.

# Create an AD-integrated primary zone (replicates to all DCs in the domain)
Add-DnsServerPrimaryZone `
    -Name "corp.example.com" `
    -ReplicationScope "Domain" `
    -DynamicUpdate "Secure"

# Create a standard (file-backed) primary zone
Add-DnsServerPrimaryZone `
    -Name "internal.example.com" `
    -ZoneFile "internal.example.com.dns" `
    -DynamicUpdate "None"

# List all configured zones
Get-DnsServerZone | Select-Object ZoneName, ZoneType, IsDsIntegrated, DynamicUpdate

Step 3: Create a Reverse Lookup Zone

Reverse lookup zones resolve IP addresses back to hostnames. These are required for many security tools, email servers, and for nslookup reverse queries.

# Create a reverse lookup zone for the 192.168.1.0/24 subnet
Add-DnsServerPrimaryZone `
    -NetworkID "192.168.1.0/24" `
    -ReplicationScope "Domain" `
    -DynamicUpdate "Secure"

# Create a reverse zone for a /16 subnet
Add-DnsServerPrimaryZone `
    -NetworkID "10.0.0.0/8" `
    -ReplicationScope "Forest" `
    -DynamicUpdate "Secure"

# List reverse zones
Get-DnsServerZone | Where-Object { $_.IsReverseLookupZone -eq $true }

Step 4: Add DNS Records

Manually adding records is required for static infrastructure components like servers, printers, and network appliances.

# Add an A record (host to IPv4)
Add-DnsServerResourceRecordA `
    -ZoneName "corp.example.com" `
    -Name "webserver01" `
    -IPv4Address "192.168.1.50" `
    -TimeToLive "01:00:00"

# Add a CNAME (alias) record
Add-DnsServerResourceRecordCName `
    -ZoneName "corp.example.com" `
    -Name "www" `
    -HostNameAlias "webserver01.corp.example.com."

# Add an MX record for mail
Add-DnsServerResourceRecordMX `
    -ZoneName "corp.example.com" `
    -Name "@" `
    -MailExchange "mail.corp.example.com" `
    -Preference 10

# Add a PTR record to the reverse zone
Add-DnsServerResourceRecordPtr `
    -ZoneName "1.168.192.in-addr.arpa" `
    -Name "50" `
    -PtrDomainName "webserver01.corp.example.com."

# Add a TXT record (e.g., SPF)
Add-DnsServerResourceRecord `
    -ZoneName "corp.example.com" `
    -Txt `
    -Name "@" `
    -DescriptiveText "v=spf1 mx a -all"

# List all records in a zone
Get-DnsServerResourceRecord -ZoneName "corp.example.com" | 
    Select-Object HostName, RecordType, RecordData | Sort-Object HostName

Step 5: Configure DNS Forwarders

Forwarders tell the DNS server where to send queries it cannot resolve from its own zones — typically to ISP resolvers or public resolvers like 8.8.8.8. Conditional forwarders route queries for specific domains to dedicated DNS servers (useful in split-brain and partner network configurations).

# Add a global forwarder (for all non-authoritative queries)
Add-DnsServerForwarder -IPAddress "8.8.8.8","8.8.4.4" -PassThru

# View current forwarders
Get-DnsServerForwarder

# Remove a forwarder
Remove-DnsServerForwarder -IPAddress "8.8.8.8"

# Add a conditional forwarder (route queries for partner.com to their DNS)
Add-DnsServerConditionalForwarderZone `
    -Name "partner.com" `
    -MasterServers "203.0.113.10","203.0.113.11" `
    -ReplicationScope "Domain"

# List conditional forwarders
Get-DnsServerZone | Where-Object { $_.ZoneType -eq "Forwarder" }

Step 6: Configure DNS Scavenging

Scavenging automatically removes stale DNS records that were dynamically registered but never cleaned up. Without scavenging, your DNS zones gradually fill with records for decommissioned machines.

# Enable scavenging on the DNS server
Set-DnsServerScavenging `
    -ScavengingState $true `
    -ScavengingInterval "7.00:00:00"

# Enable aging on a specific zone
Set-DnsServerZoneAging `
    -ZoneName "corp.example.com" `
    -Aging $true `
    -NoRefreshInterval "4.00:00:00" `
    -RefreshInterval "4.00:00:00"

# Run scavenging immediately (removes records older than NoRefresh + Refresh window)
Start-DnsServerScavenging

# View scavenging settings
Get-DnsServerScavenging

Step 7: Verify DNS Resolution

# Test forward resolution from the command line
nslookup webserver01.corp.example.com

# Test with Resolve-DnsName (PS 4.0)
Resolve-DnsName -Name "webserver01.corp.example.com" -Server "192.168.1.1"

# Test reverse resolution
Resolve-DnsName -Name "192.168.1.50" -Type PTR -Server "192.168.1.1"

# Check DNS server statistics
Get-DnsServerStatistics | Select-Object -ExpandProperty Query | 
    Select-Object TotalQueries, TotalResponses

# View DNS debug log
Get-DnsServerDiagnostics

# Flush and re-register DNS on a client
ipconfig /flushdns
ipconfig /registerdns

# View the DNS cache on the server
Get-DnsServerCache | Select-Object HostName, RecordType -First 20

Summary

A correctly configured DNS server is non-negotiable for a functional Windows Server 2012 R2 environment. The key tasks are: install the DNS Server role, create AD-integrated forward and reverse lookup zones with secure dynamic updates enabled, add static A/CNAME/MX/PTR records for infrastructure components, configure forwarders to upstream resolvers for external name resolution, set up conditional forwarders for any partner or split-horizon domains, and enable scavenging to keep zones clean. The DnsServer PowerShell module makes every aspect of DNS management fully scriptable, which is essential for consistent, repeatable configuration across multiple DNS servers in your domain.

How to Configure a DNS Server on Windows Server 2012 R2