Troubleshoot a Windows DNS Server That Does Not Answer Queries

Before you begin

Applicable to supported Windows Server/client environments where the named role or feature is installed. Run read-only checks first from an elevated PowerShell or Command Prompt as appropriate. Replace example hostnames, domain names, addresses, ports and paths with values from the affected environment. Record the exact error, timestamp, OS build and scope of impact.

Production safety: obtain change approval and a verified backup before modifying AD DS, DNS, DHCP, firewall, IIS, storage or Hyper-V configuration. Ensure console/out-of-band access before network or remote-access changes.

Symptoms and likely root cause

Clients receive DNS request timed out or Server failed although the DNS Server role is installed and the host is online.

DNS service state, listener bindings, zone load, recursion/forwarders, active firewall profile or network ACL.

Diagnostic commands

Get-Service DNS
Get-DnsServer
Get-DnsServerSetting -All
Get-NetUDPEndpoint -LocalPort 53
Get-NetTCPConnection -LocalPort 53 -State Listen
Resolve-DnsName dc01.corp.example.com -Server 127.0.0.1
Resolve-DnsName dc01.corp.example.com -Server 10.20.0.10

Run the commands in order and save the complete output. The commands above are intended to establish the failing layer before a configuration change is attempted.

How to interpret the results

The service should be Running and port 53 should be bound to the intended server interface. Compare queries against loopback, the server NIC address and a remote client. A TCP port test alone does not prove UDP DNS works.

Practical correction

If local queries work but remote queries time out, inspect inbound DNS firewall rules, VLAN ACLs and routing. If local queries fail for one zone, inspect DNS Server events and zone state; export the zone before any repair: Export-DnsServerZone -Name corp.example.com -FileName corp.example.com.dns.

Make one change at a time. Re-run the failed diagnostic after each change so the cause-and-effect relationship is clear.

Fallback and recovery

Restore the previous firewall rule or DNS listener setting if other sites/subnets lose service. Restore zone data only from a verified export/backup and only after identifying the failed zone. Never disable all firewall profiles.

Verification checklist

Success: authoritative internal queries work locally and from each affected subnet; external recursion works only where configured. Check DNS Server event log and forwarder health separately.

• Repeat the original failing operation from the affected client/user or service.
• Test from a second approved endpoint or subnet where relevant.
• Review the relevant event log/IIS log after the fix.
• Record the change, actual result and any remaining limitation.

Frequently asked question

Does ping prove DNS works? No. Ping tests ICMP, not DNS query handling. Test a real DNS query from a client.

Official technical reference

Microsoft Learn — troubleshoot dns server

Use the official documentation for exact version support, prerequisites and any procedure that differs between Windows Server releases.

Technician field note

This runbook describes a controlled diagnostic path; it is not a universal guarantee that every environment has the same cause. If evidence does not match the expected result, stop and investigate rather than applying unrelated fixes. Do not mark the incident resolved until the original symptom is verified as cleared.