How to Configure DNS Forwarders on Windows Server
Applies to: Windows Server 2019, 2022 and 2025.
Forwarders send unresolved recursive queries to approved upstream resolvers. Domain members should still query AD DNS servers directly.
DNS and DHCP changes can interrupt authentication and remote access. Preserve console access, export current settings and test from representative clients. Managed Windows VPS services are available at networkmanager.info.
Prerequisites
- Select trusted reachable upstream resolvers.
- Confirm firewall access to UDP and TCP 53.
- Record existing forwarders.
- Decide whether root hints remain available.
Procedure
Step 1: Read current settings
Capture forwarder addresses and timeout.
Get-DnsServerForwarderStep 2: Add approved resolvers
Use provider or organizational addresses.
Add-DnsServerForwarder -IPAddress '192.0.2.53','192.0.2.54' -PassThruStep 3: Test each upstream path
Query an external name through the local server.
Resolve-DnsName networkmanager.info -Server 127.0.0.1Step 4: Review recursion policy
Do not expose an unrestricted recursive resolver to the internet.
Step 5: Monitor failures
Watch DNS Server event logs and query latency.
Verification
The list should contain only approved addresses and recursive queries should succeed.
Get-DnsServerForwarder
Resolve-DnsName learn.microsoft.com -Server 127.0.0.1Rollback
Remove newly added addresses with Remove-DnsServerForwarder and restore the recorded list.
Operational notes
Forwarders affect unresolved names; authoritative zones and conditional forwarders can take precedence.
