Windows DNS Server Configuration

This guide covers the complete configuration of Windows DNS Server from initial installation through advanced settings optimization for enterprise environments.

Initial Server Setup

Installing DNS Server Role

# Install DNS Server Role using PowerShell
Install-WindowsFeature -Name DNS -IncludeManagementTools -Restart

# Verify installation
Get-WindowsFeature -Name DNS

# Check DNS service status
Get-Service DNS

Post-Installation Configuration

# Configure DNS service startup
Set-Service DNS -StartupType Automatic

# Start DNS service if not running
Start-Service DNS

# Verify DNS server is listening
Test-NetConnection -ComputerName localhost -Port 53 -InformationLevel Detailed

Core DNS Configuration

Root Hints Configuration

# View current root hints
Get-DnsServerRootHint

# Remove all root hints (for internal-only DNS)
Get-DnsServerRootHint | Remove-DnsServerRootHint -Force

# Add custom root hints for internal hierarchy
Add-DnsServerRootHint -NameServer "ns1.corp.contoso.com" -IPAddress "192.168.1.10"
Add-DnsServerRootHint -NameServer "ns2.corp.contoso.com" -IPAddress "192.168.1.11"

# Import root hints from file
dnscmd /Config /BootMethod 1
dnscmd /Config /RootBreakOnLoading 0

Forwarder Configuration

# Configure conditional forwarders
Add-DnsServerConditionalForwarderZone -Name "external.com" -MasterServers "8.8.8.8", "8.8.4.4"

# Set global forwarders
Set-DnsServerForwarder -IPAddress "1.1.1.1", "1.0.0.1" -UseRootHint $false

# Configure forwarder timeout and recursion
Set-DnsServerRecursion -Enable $true -Timeout 15 -AdditionalTimeout 4

# View forwarder configuration
Get-DnsServerForwarder
Get-DnsServerConditionalForwarderZone

Advanced Server Settings

# Configure cache settings
Set-DnsServerCache -MaxKBSize 10240 -MaxNegativeTtl "00:15:00" -MaxTtl "1.00:00:00"

# Enable/disable recursion
Set-DnsServerRecursion -Enable $true

# Configure listening addresses
Set-DnsServerSetting -ListeningIPAddress "192.168.1.10", "10.0.1.10"

# Set DNS server interfaces
Set-DnsServerSetting -All -CreateFileBackedPrimaryZones $true

Scavenging and Aging

Enable Scavenging

# Enable scavenging on server
Set-DnsServerScavenging -ScavengingState $true -RefreshInterval "7.00:00:00" -NoRefreshInterval "7.00:00:00"

# Configure scavenging for specific zones
Set-DnsServerZoneAging -Name "contoso.com" -Aging $true -RefreshInterval "7.00:00:00" -NoRefreshInterval "7.00:00:00"

# Start manual scavenging
Start-DnsServerScavenging

# View scavenging statistics
Get-DnsServerStatistics | Select-Object *Scaven*

Aging Configuration Best Practices

# Recommended aging settings for enterprise environments
$RefreshInterval = "7.00:00:00"  # 7 days
$NoRefreshInterval = "7.00:00:00"  # 7 days

# Apply to all zones
Get-DnsServerZone | Where-Object {$_.ZoneType -eq "Primary" -and $_.IsDsIntegrated} | 
    Set-DnsServerZoneAging -Aging $true -RefreshInterval $RefreshInterval -NoRefreshInterval $NoRefreshInterval

# Monitor aging
Get-DnsServerZone | Where-Object Aging | Select-Object ZoneName, Aging, RefreshInterval, NoRefreshInterval

Monitoring and Logging

Enable DNS Debug Logging

# Enable comprehensive debug logging
Set-DnsServerDiagnostics -All $true

# Enable specific event logging
Set-DnsServerDiagnostics -Queries $true -Answers $true -Notifications $true

# Configure log file location and size
Set-DnsServerDiagnostics -EnableLogFileRollover $true -LogFilePath "C:\Windows\System32\dns\dns.log" -MaxMBFileSize 100

# View current diagnostic settings
Get-DnsServerDiagnostics

Performance Monitoring

# Monitor DNS performance counters
Get-Counter -Counter "\DNS\Total Query Received/sec" -SampleInterval 5 -MaxSamples 12

# Monitor specific DNS server metrics
$Counters = @(
    "\DNS\Total Query Received/sec",
    "\DNS\Total Response Sent/sec", 
    "\DNS\Recursive Queries/sec",
    "\DNS\UDP Query Received/sec",
    "\DNS\TCP Query Received/sec"
)

Get-Counter -Counter $Counters -SampleInterval 10 -MaxSamples 6 | 
    Select-Object Timestamp, @{Name="Server";Expression={$_.CounterSamples[0].InstanceName}}, 
    @{Name="QueriesPerSec";Expression={$_.CounterSamples[0].CookedValue}}

Security Configuration

Secure DNS Server Settings

# Disable recursion for external queries (if authoritative only)
Set-DnsServerRecursion -Enable $false

# Configure response rate limiting
Set-DnsServerResponseRateLimiting -Mode Enable -ResponsesPerSec 5 -ErrorsPerSec 5 -WindowInSec 5

# Enable DNS socket pool
Set-DnsServerSetting -SocketPoolSize 2500

# Configure bind secondaries prevention
Set-DnsServerSetting -BindSecondaries $false

Access Control Configuration

# Configure server access control
$ACL = Get-DnsServerQueryResolutionPolicy
New-DnsServerQueryResolutionPolicy -Name "Block-External" -Fqdn "EQ,*.internal.com" -Action DENY

# Configure zone transfer restrictions
Set-DnsServerPrimaryZone -Name "contoso.com" -SecureSecondaries "SecureNs" -SecondaryServers "192.168.1.11", "192.168.1.12"

# Enable notify list for zone updates  
Set-DnsServerPrimaryZone -Name "contoso.com" -Notify "NotifyServers" -NotifyServers "192.168.1.11", "192.168.1.12"

Advanced Features Configuration

DNS Policies

# Create subnet-based DNS policy for geolocation
Add-DnsServerClientSubnet -Name "US-East" -IPv4Subnet "192.168.1.0/24"
Add-DnsServerClientSubnet -Name "US-West" -IPv4Subnet "10.0.1.0/24"

Add-DnsServerZoneScope -ZoneName "contoso.com" -Name "USEastScope"
Add-DnsServerResourceRecord -ZoneName "contoso.com" -A -Name "web" -IPv4Address "192.168.1.100" -ZoneScope "USEastScope"

Add-DnsServerQueryResolutionPolicy -Name "USEastPolicy" -ZoneName "contoso.com" -ClientSubnet "EQ,US-East" -ZoneScope "USEastScope,1"

GlobalNames Zone

# Create GlobalNames zone for single-label name resolution
Add-DnsServerPrimaryZone -Name "GlobalNames" -ReplicationScope "Forest" -DynamicUpdate "Secure"

# Enable GlobalNames zone functionality
Set-DnsServerGlobalNameZone -AlwaysQueryServer $true -Enable $true -GlobalOverLocal $true

# Add single-label name records
Add-DnsServerResourceRecordCName -ZoneName "GlobalNames" -Name "intranet" -HostNameAlias "intranet.contoso.com"

Performance Optimization

Cache Optimization

# Optimize cache settings for high-volume environments
Set-DnsServerCache -MaxKBSize 20480 -MaxNegativeTtl "00:05:00" -MaxTtl "01:00:00"

# Configure cache locking
Set-DnsServerCache -LockingPercent 80

# Monitor cache statistics
Get-DnsServerStatistics | Select-Object *Cache*

Memory and Resource Optimization

# Configure socket pool for high-performance
Set-DnsServerSetting -SocketPoolSize 5000

# Optimize EDNS settings
Set-DnsServerEDns -EnableProbes $true -CacheTimeout "00:15:00"

# Configure maximum UDP packet size
Set-DnsServerSetting -MaximumUdpPacketSize 4096

Maintenance Scripts

Daily Health Check

function Test-DnsServerHealth
{
    [CmdletBinding()]
    param(
        [string]$LogPath = "C:\DNS-Logs\HealthCheck_$(Get-Date -Format 'yyyy-MM-dd').log"
    )
    
    $Results = @()
    
    # Test DNS service
    $Service = Get-Service DNS
    $Results += [PSCustomObject]@{
        Check = "DNS Service Status"
        Status = $Service.Status
        Result = if ($Service.Status -eq "Running") { "PASS" } else { "FAIL" }
    }
    
    # Test zone loading
    $Zones = Get-DnsServerZone
    $LoadedZones = $Zones | Where-Object {$_.IsLoaded -eq $true}
    $Results += [PSCustomObject]@{
        Check = "Zone Loading"
        Status = "$($LoadedZones.Count)/$($Zones.Count) zones loaded"
        Result = if ($LoadedZones.Count -eq $Zones.Count) { "PASS" } else { "WARN" }
    }
    
    # Test recursive resolution
    try {
        $Resolve = Resolve-DnsName "google.com" -Server "127.0.0.1" -Type A
        $Results += [PSCustomObject]@{
            Check = "Recursive Resolution"
            Status = "External resolution working"
            Result = "PASS"
        }
    }
    catch {
        $Results += [PSCustomObject]@{
            Check = "Recursive Resolution"
            Status = "Failed: $($_.Exception.Message)"
            Result = "FAIL"
        }
    }
    
    # Check event log for errors
    $Errors = Get-WinEvent -FilterHashtable @{LogName='DNS Server'; Level=2; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
    $Results += [PSCustomObject]@{
        Check = "Event Log Errors (24h)"
        Status = "$($Errors.Count) errors found"
        Result = if ($Errors.Count -eq 0) { "PASS" } else { "WARN" }
    }
    
    # Output results
    $Results | Format-Table -AutoSize
    
    # Log results
    if ($LogPath) {
        $Results | Export-Csv -Path $LogPath -NoTypeInformation
        Write-Host "Health check results saved to: $LogPath" -ForegroundColor Green
    }
    
    return $Results
}

# Run daily health check
Test-DnsServerHealth

Configuration Backup

function Backup-DnsServerConfiguration
{
    [CmdletBinding()]
    param(
        [string]$BackupPath = "C:\DNS-Backups\DNS-Config_$(Get-Date -Format 'yyyy-MM-dd_HH-mm-ss')"
    )
    
    # Create backup directory
    New-Item -Path $BackupPath -ItemType Directory -Force
    
    # Backup zones
    Get-DnsServerZone | ForEach-Object {
        Export-DnsServerZone -Name $_.ZoneName -FileName "$($_.ZoneName).bak" -Path $BackupPath
    }
    
    # Backup server settings
    Get-DnsServerSetting | Export-Clixml -Path "$BackupPath\ServerSettings.xml"
    Get-DnsServerForwarder | Export-Clixml -Path "$BackupPath\Forwarders.xml"
    Get-DnsServerRootHint | Export-Clixml -Path "$BackupPath\RootHints.xml"
    
    # Backup registry settings
    reg export "HKLM\SYSTEM\CurrentControlSet\Services\DNS" "$BackupPath\DNS-Registry.reg"
    
    Write-Host "DNS configuration backed up to: $BackupPath" -ForegroundColor Green
    
    return $BackupPath
}

# Create weekly backup
Backup-DnsServerConfiguration

Best Practices Summary

Configuration Guidelines

Always use AD-integrated zones for better security and replication
Configure appropriate scavenging to prevent stale records
Set up monitoring and logging for proactive management
Implement security policies to prevent DNS attacks
Regular backup of DNS configuration and zone data

Performance Recommendations

Optimize cache settings based on query patterns
Configure socket pools for high-volume environments
Use conditional forwarders for external domains
Monitor performance counters regularly
Implement load balancing for multiple DNS servers

Security Best Practices

Disable unnecessary features (recursion for authoritative servers)
Configure response rate limiting to prevent DDoS
Use secure dynamic updates for AD-integrated zones
Implement DNS policies for access control
Regular security audits and updates

Table of Contents

Initial Server Setup

Installing DNS Server Role

Post-Installation Configuration

Core DNS Configuration

Root Hints Configuration

Forwarder Configuration

Advanced Server Settings

Scavenging and Aging

Enable Scavenging

Aging Configuration Best Practices

Monitoring and Logging

Enable DNS Debug Logging

Performance Monitoring

Security Configuration

Secure DNS Server Settings

Access Control Configuration

Advanced Features Configuration

DNS Policies

GlobalNames Zone

Performance Optimization

Cache Optimization

Memory and Resource Optimization

Maintenance Scripts

Daily Health Check

Configuration Backup

Best Practices Summary

Configuration Guidelines

Performance Recommendations

Security Best Practices