Applies to: DNS Server role on supported Windows Server versions (2019, 2022, 2025), according to Microsoft’s documentation; not tested here
To set up a DNS server on Windows Server, install the DNS Server role, create a forward lookup zone for your domain and add records to it. In PowerShell that is three commands: Install-WindowsFeature -Name DNS, Add-DnsServerPrimaryZone and Add-DnsServerResourceRecordA. If the server is on the internet, also switch off recursion so it doesn’t answer lookups for strangers.
Before you start
- The server needs a static IP address and an account in the Administrators group.
- Decide what the server is for. Authoritative: it answers for your own domains (your nameservers). Resolver: it looks up any name for computers on your own network, using forwarders or the root servers. A public VPS should normally be only the first.
1. Install the DNS Server role
In PowerShell as administrator:
Install-WindowsFeature -Name DNS -IncludeManagementTools
According to Microsoft, the installation doesn’t need a reboot. -IncludeManagementTools adds the DNS Manager console and the PowerShell module.
With the desktop: open Server Manager, choose Manage > Add Roles and Features, select Role-based or feature-based installation, keep your server on Select destination server, tick DNS Server on Select server roles, accept Add Features, then Next and Install.
2. Create a forward lookup zone
A zone holds the records of one domain. For a standalone server (not a domain controller), create a file-based primary zone:
Add-DnsServerPrimaryZone -Name "example.com" -ZoneFile "example.com.dns"
In DNS Manager (Server Manager > Tools > DNS): right-click the server, choose New Zone, then Primary zone, Forward lookup zone, the zone name (example.com), the suggested zone file example.com.dns, and Do not allow dynamic updates unless you need them. The file is kept in %SystemRoot%\System32\dns.
3. Add records
Add-DnsServerResourceRecordA -Name "www" -ZoneName "example.com" -IPv4Address "203.0.113.10" -TimeToLive 01:00:00 Add-DnsServerResourceRecordA -Name "mail" -ZoneName "example.com" -IPv4Address "203.0.113.20" Add-DnsServerResourceRecordMX -Name "." -ZoneName "example.com" -MailExchange "mail.example.com" -Preference 10 Add-DnsServerResourceRecordCName -Name "ftp" -HostNameAlias "www.example.com" -ZoneName "example.com"
For the MX record, Microsoft’s reference says to use a dot (.) as the name to mean the domain itself. TXT records (SPF, site verification) are added with Add-DnsServerResourceRecord -Txt -Name ... -DescriptiveText "...". In DNS Manager, right-click the zone and choose New Host (A or AAAA), New Alias (CNAME), New Mail Exchanger (MX) or Other New Records for TXT and SRV; leave the name blank there to add a TXT record for the domain itself. List what the zone holds with:
Get-DnsServerResourceRecord -ZoneName "example.com"
If you are new to record types, see understanding DNS zone files.
4. Resolver only: add forwarders
If the server resolves names for your own network, you can send lookups it can’t answer to upstream DNS servers instead of the root servers:
Set-DnsServerForwarder -IPAddress "1.1.1.1","8.8.8.8"
In DNS Manager this is Properties > Forwarders > Edit. Root hints are then only used when the forwarders don’t answer.
5. Public server: turn off recursion
A new DNS server also looks up names it doesn’t host (recursion), using the root hints that are filled in by default. On an internet-facing server that makes it an open resolver for anyone, which attackers abuse to flood other networks (RFC 5358 describes these reflector attacks). If the server only answers for your own zones, switch recursion off:
Set-DnsServerRecursion -Enable $false
In DNS Manager: server Properties, Advanced tab, Disable recursion. This also disables any forwarders. If internal computers need it as a resolver, keep recursion on and allow port 53 in the firewall only from your own addresses.
You can also make the server listen on one IP address only: in the server’s Properties, choose Only the following IP addresses and tick the address.
6. Open port 53 and test
DNS uses port 53 over UDP and TCP (when DNS uses TCP or UDP). If clients get no answer, allow both in the firewall, see allow a port in Windows Firewall. Then test on the server:
Resolve-DnsName -Name www.example.com -Server 127.0.0.1 Resolve-DnsName -Name example.com -Type MX -Server 127.0.0.1
From a Linux machine: dig @203.0.113.5 www.example.com, where 203.0.113.5 is your DNS server (see DNS lookup commands). To make the server the nameserver for your domain, register nameserver names at your domain registrar, see create custom nameservers using your domain.
Remove the role
Uninstall-WindowsFeature -Name DNS
Microsoft says to restart afterwards. Zone files stay in %SystemRoot%\System32\dns but are not loaded again if you reinstall the role.
A Windows VPS comes with the Windows Server licence included, if you want a separate DNS server.
Official documentation: install and configure DNS Server, manage DNS zones and manage resource records.
