Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.
DNS Response Policy Zones can block or redirect known malicious domain lookups using locally governed rules.
Prerequisites
- Administrative access to the affected Windows Server hosts.
- A tested backup or documented rollback point.
- An approved maintenance window for production systems.
Step-by-step configuration
- Define approved threat indicators and expiry dates.
- Create an RPZ zone with a descriptive name.
- Add a rule for a test domain using a non-production action.
- Enable query logging for the pilot.
- Validate behavior from approved clients before adding production indicators.
PowerShell and command-line procedure
Add-DnsServerResponseRateLimiting -ErrorAction SilentlyContinue
Add-DnsServerResponsePolicyZone -Name "Security-RPZ"
Add-DnsServerResponsePolicy -Name "Block-Test-Domain" -ZoneName "Security-RPZ" -Fqdn "EQ,bad.example" -Action DENY
Get-DnsServerResponsePolicy
Verification
The test query receives the configured response while unrelated DNS queries resolve normally.
Rollback
Disable or remove the named response policy and confirm normal resolution is restored.
Security and operational guidance
- Apply least privilege and document every production change.
- Test the procedure in an isolated environment before broad deployment.
- Replace all example names, paths, and TEST-NET addresses with approved production values.
- Monitor relevant Windows event logs after the change.
Related resources
Deploy or manage Canadian Windows VPS infrastructure with networkmanager.info. Validate production decisions against the official Microsoft Windows Server documentation.
