Domains and DNS

Every Windows DNS server ships with a list of thirteen root nameservers baked in. The list is the bootstrap that lets the server resolve any name on the public internet without depending on an upstream resolver. Most admins never touch it. In two specific situations — split-brain environments and resolvers that shouldn't reach public DNS at all — leaving the default in place is actively wrong. Here's what root hints actually do, when they help, and when to empty the file.

Most Windows DNS servers run on defaults that worked fine in 2008 and haven't really been revisited. A handful of those defaults — open recursion, no cache-pollution protection, no scavenging, listening on every interface — don't hold up in a modern enterprise threat environment. Here's what every server-level DNS setting actually does, and a baseline configuration sequence that takes a fresh DNS server from 'installed' to 'production-ready' in about ten minutes.

A reverse lookup zone is the database on a DNS server that answers the opposite question from a forward zone — instead of 'what's the IP for this name,' it answers 'what name belongs to this IP.' Most clients don't query reverse DNS often, but the ones that do (mail systems, RDP, audit tools, monitoring) fall over noisily when reverse zones are missing or wrong. Here's the full picture, from what a reverse zone is to how to set one up across odd subnet boundaries.

A forward lookup zone is the database on a DNS server that answers 'what's the IP address for this hostname.' In a Windows Server environment running Active Directory, the choices you make when creating that zone — primary vs secondary vs AD-integrated, who replicates it, who can update records in it — determine whether your forest is robust or fragile for years afterward. Here's the full picture, written for someone who knows DNS exists but hasn't actually configured a Windows DNS server before.

OOF is turned on but external senders aren't getting replies. Walk the external-replies toggle, the once-per-sender rule, the spam-filter override, transport rules that suppress OOFs, and the remote domain configuration that controls everything.

The wizard makes adding a domain to Microsoft 365 look like a checklist. Then six months later marketing wonders why their broadcasts are landing in spam. Here's the order to configure SPF, DKIM, and DMARC for an EXO tenant, the seven mistakes I see most often, and the staged DMARC enforcement that doesn't break payroll.