How to Create an Active Directory-Integrated DNS Forward Lookup Zone
Applies to: Windows Server 2019, 2022 and 2025.
An AD-integrated zone replicates through Active Directory and supports secure dynamic updates without separate zone-transfer files.
DNS and DHCP changes can interrupt authentication and remote access. Preserve console access, export current settings and test from representative clients. Managed Windows VPS services are available at networkmanager.info.
Prerequisites
- Use a domain controller running DNS.
- Select the exact DNS namespace.
- Verify replication health.
- Decide the AD replication scope.
Procedure
Step 1: Review current zones
Avoid duplicate namespaces.
Get-DnsServerZoneStep 2: Create the zone
Replicate to DNS servers in the domain and require secure updates.
Add-DnsServerPrimaryZone -Name 'apps.corp.example' -ReplicationScope Domain -DynamicUpdate SecureStep 3: Inspect properties
Confirm type, scope and update policy.
Get-DnsServerZone -Name 'apps.corp.example'Step 4: Add an initial record
Create a controlled test record.
Add-DnsServerResourceRecordA -ZoneName 'apps.corp.example' -Name 'test' -IPv4Address '192.0.2.30'Step 5: Allow replication
Validate from another DNS controller.
Verification
Query the SOA and test record from more than one server.
Resolve-DnsName -Type SOA apps.corp.example
Resolve-DnsName test.apps.corp.exampleRollback
Remove test records first. Remove-DnsServerZone only after confirming no clients, delegations or applications depend on the namespace.
Operational notes
Use secure dynamic updates for AD-integrated zones unless a documented legacy requirement dictates otherwise.
