Active Directory DNS: Zones, Records & Best Practices 2025

Last updated Nov 19, 2025 0

Quick Summary: DNS is required for Active Directory to function correctly — it enables domain controller discovery, service location (SRV records), and name resolution for clients and servers.

What is Active Directory DNS?
DNS vs Active Directory
DNS Zones & Records
Common DNS Record Types
Benefits of AD-Integrated DNS
Active Directory DNS Best Practices
Examples & Commands
FAQ

What is Active Directory DNS?

The Domain Name System (DNS) converts domain names to IP addresses (for example, www.google.com → 8.8.8.8) and vice versa. Active Directory Domain Services (AD DS) relies on DNS so that domain-joined clients can locate domain controllers and other AD services. DNS is typically installed and configured during the AD DS deployment.

What is the Difference Between DNS and Active Directory?

Active Directory is a centralized identity and access management platform for users, computers, and network resources. DNS (Domain Name System) translates hostnames into IP addresses and enables service discovery (SRV records) used by AD for authentication and replication.

DNS Zones and Records

A DNS zone stores DNS resource records. In Active Directory-integrated DNS, you will commonly see the following zone types:

Primary Zone

The primary zone contains a writable copy of the zone data. Administrators can create, edit, or delete records. On Windows Server the zone data is typically located in %SystemRoot%\System32\DNS when using a file-backed zone.

Secondary Zone

A secondary zone is a read-only copy of a primary zone. It receives zone transfers from the primary and can help distribute query load — useful in branch offices or when you need additional DNS servers without writable authority.

Stub Zone

Stub zones store a subset of records (SOA, NS, and A) that help a DNS server resolve names for a delegated domain. They are read-only and useful for limited delegation scenarios.

Forward & Reverse Lookup Zones

A forward lookup zone maps hostnames to IPs (A and AAAA records). A reverse lookup zone maps IP addresses back to hostnames (PTR records).

Common DNS Record Types

A Record — maps a hostname to an IPv4 address. Example: www.example.com → 142.250.74.4
AAAA Record — maps a hostname to an IPv6 address.
CNAME Record — aliases one name to another (e.g., help.example.com → support.example.com).
MX Record — mail exchange record for email delivery (with priority).
TXT Record — stores arbitrary text, often used for SPF, DKIM, and domain verification.
SRV Record — service record used by Active Directory to locate domain controllers and services (includes hostname + port).
PTR Record — pointer record used in reverse zones to map IP → hostname.

Benefits of Integrating DNS with Active Directory

Improved replication and secure transfer of zone data between domain controllers.
Automatic distribution of DNS data to new domain controllers added to the domain.
Support for secure dynamic updates which improve record security and management.

Active Directory DNS Best Practices (Checklist)

Run at least two DNS servers in each site for redundancy.
Configure domain clients to use internal DNS servers only.
Use AD-integrated DNS zones to leverage secure replication and simpler management.
Enable secure dynamic updates where appropriate.
Set DNS order on domain controllers: use itself as primary DNS and another DC as secondary.
Enable aging and scavenging to remove stale records (after careful review).

Quick Checklist (copy/paste):

1. Verify at least two DNS servers per AD site
2. Ensure clients use internal DNS
3. Enable secure dynamic updates
4. Configure aging & scavenging (test first)

Examples & Commands

Useful commands for troubleshooting and verification:

nslookup domain-controller.example.local
ipconfig /displaydns
Get-DnsServerZone -ComputerName DC01 -ZoneName "example.local"  # PowerShell

Example: Creating an AD-integrated zone (PowerShell)

Add-DnsServerPrimaryZone -Name "example.local" -ReplicationScope "Domain" -ComputerName DC01

Example SRV record format (used by AD): _ldap._tcp.dc._msdcs.example.local

FAQ: Common Active Directory DNS Questions

Does Active Directory require DNS?

Yes — AD depends on DNS for service discovery and domain controller location. Without DNS, clients cannot find domain controllers reliably.

What happens if DNS fails in Active Directory?

Authentication and replication may fail. Domain-joined clients might be unable to log in if they cannot locate domain controllers via DNS.

How many DNS servers should I configure?

At least two per AD site for redundancy, but larger environments may require more depending on load and topology.

Should I enable aging and scavenging?

Yes, but only after understanding the environment. Misconfigured scavenging can remove active records — test in a lab first.