Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.
DNSSEC adds origin authentication and integrity validation to DNS responses for a signed authoritative zone.
Prerequisites
- Administrative access to the affected Windows Server hosts.
- A tested backup or documented rollback point.
- An approved maintenance window for production systems.
Step-by-step configuration
- Confirm client and resolver compatibility and create a key rollover plan.
- Back up the zone and DNS server configuration.
- Sign a lab copy or low-risk zone first.
- Distribute trust anchors where validation requires them.
- Test positive responses, negative responses, and rollover procedures.
PowerShell and command-line procedure
Get-DnsServerZone -Name "secure.contoso.example"
Invoke-DnsServerZoneSign -ZoneName "secure.contoso.example" -SignWithDefault -PassThru
Get-DnsServerSigningKey -ZoneName "secure.contoso.example"
Resolve-DnsName host.secure.contoso.example -DnssecOk
Verification
Signed queries return DNSSEC records and validation-aware resolvers accept both existing and non-existing-name responses.
Rollback
Use the supported zone unsigning procedure only during a controlled window and restore the backed-up unsigned configuration if required.
Security and operational guidance
- Apply least privilege and document every production change.
- Test the procedure in an isolated environment before broad deployment.
- Replace all example names, paths, and TEST-NET addresses with approved production values.
- Monitor relevant Windows event logs after the change.
Related resources
Deploy or manage Canadian Windows VPS infrastructure with networkmanager.info. Validate production decisions against the official Microsoft Windows Server documentation.
