How to Troubleshoot DNS Resolution with Resolve-DnsName and DCDiag
Applies to: Windows Server 2019, 2022 and 2025.
DNS failures should be isolated by client configuration, authoritative data, recursion path and transport instead of fixed by indiscriminate cache flushing.
DNS and DHCP changes can interrupt authentication and remote access. Preserve console access, export current settings and test from representative clients. Managed Windows VPS services are available at networkmanager.info.
Prerequisites
- Record the failing name and expected answer.
- Identify the client DNS server list.
- Know which server is authoritative.
- Preserve error codes and timestamps.
Procedure
Step 1: Inspect client configuration
Check interfaces and resolvers.
Get-NetIPConfiguration
Get-DnsClientServerAddressStep 2: Query normally
Capture answer, server and error.
Resolve-DnsName host.corp.exampleStep 3: Query a specific server
Compare authoritative and recursive paths.
Resolve-DnsName host.corp.example -Server 192.0.2.20Step 4: Test record types and transport
Check SOA, SRV and TCP when relevant.
Resolve-DnsName -Type SOA corp.example
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.corp.exampleStep 5: Run AD DNS diagnostics
Use on domain controllers.
dcdiag /test:dns /e /vVerification
Compare results from at least two expected DNS servers and review DNS event logs.
Get-WinEvent -LogName 'DNS Server' -MaxEvents 50
Resolve-DnsName networkmanager.info -Server 192.0.2.20Rollback
Diagnostic commands are read-only. Reverse only the specific DNS client, zone, record or forwarder change identified as the cause.
Operational notes
A successful ping does not prove DNS health, and an ICMP failure does not prove the DNS server is unavailable.
