How to Configure a Conditional DNS Forwarder
Applies to: Windows Server 2019, 2022 and 2025.
A conditional forwarder routes queries for one namespace to specific authoritative or recursive DNS servers, useful for partner networks and separate AD forests.
DNS and DHCP changes can interrupt authentication and remote access. Preserve console access, export current settings and test from representative clients. Managed Windows VPS services are available at networkmanager.info.
Prerequisites
- Confirm the target namespace and server addresses.
- Test network reachability on TCP and UDP 53.
- Agree on replication scope.
- Avoid creating a forwarder that conflicts with a local authoritative zone.
Procedure
Step 1: Check namespace ownership
List local zones and existing conditional forwarders.
Get-DnsServerZoneStep 2: Create the forwarder
Use an AD-integrated conditional forwarder replicated in the domain.
Add-DnsServerConditionalForwarderZone -Name 'partner.example' -MasterServers '198.51.100.10','198.51.100.11' -ReplicationScope DomainStep 3: Query through local DNS
Test an existing partner record.
Resolve-DnsName host.partner.example -Server 127.0.0.1Step 4: Test master availability
Check DNS port reachability.
Test-NetConnection 198.51.100.10 -Port 53Step 5: Validate from another DNS server
Allow AD replication before concluding failure.
Verification
The conditional zone should list the expected master servers.
Get-DnsServerZone -Name 'partner.example'
Resolve-DnsName host.partner.exampleRollback
Remove-DnsServerZone -Name 'partner.example' after confirming the conditional forwarder is not used by applications or trusts.
Operational notes
A conditional forwarder is not a trust and does not grant access; it only controls name-resolution routing.
