Troubleshoot Windows Server DNS failures involving service health, listeners, zones, forwarders, recursion and client resolution.
Start with Check the DNS service and work through the six diagnostic checks in order.
Record results before changing configuration and validate the original symptom after each controlled change.
Quick checks
Start with the basic checks in this runbook before moving to deeper troubleshooting.
- Confirm the affected service or component is available.
- Check recent configuration or connectivity changes.
- Run the relevant commands and compare the result with the expected state.
Check the DNS service
Confirm the DNS Server service is running and listening on the expected interfaces.
Test local resolution
Query the local DNS server to determine whether the problem exists on the server itself.
Check zones and records
Verify authoritative zones and required records exist and are current.
Check forwarders
Check configured forwarders and test reachability to upstream DNS servers.
Check recursion and firewall
Confirm recursion is intentional and DNS traffic is permitted by Windows Firewall and network controls.
Retest from a client
Repeat the same query from an affected client to separate server-side and client-side failures.
Useful commands
Run these checks from an appropriate administrative session and replace example values with your environment.
DNS service
Get-Service DNSDNS query
Resolve-DnsName <fqdn> -Server <dns-server-ip>Quick troubleshooting path
Use this sequence to isolate the failing dependency before changing production configuration.
- Check the DNS service → Confirm the DNS Server service is running and listening on the expected interfaces.
- Test local resolution → Query the local DNS server to determine whether the problem exists on the server itself.
- Check zones and records → Verify authoritative zones and required records exist and are current.
- Check forwarders → Check configured forwarders and test reachability to upstream DNS servers.
- Check recursion and firewall → Confirm recursion is intentional and DNS traffic is permitted by Windows Firewall and network controls.
- Retest from a client → Repeat the same query from an affected client to separate server-side and client-side failures.
What good troubleshooting looks like
Good infrastructure troubleshooting is evidence-driven. Capture the original state, test the dependency that can prove or disprove your hypothesis, make the smallest safe change and repeat the original test.
Symptom → hypothesis → direct test → result → controlled change → validation → documentation