Sanu VargheseIT & AI notes
Tutorials › Networking
BeginnerNetworking · about 10 min · 24 October 2026

Add a conditional forwarder to Windows DNS

A conditional forwarder tells your Windows DNS server: for this one domain, ask these specific DNS servers. It's the clean way to resolve names in a partner's domain, a second forest, or a site linked by VPN, without copying their zones.

Before you start

  • You need to be signed in with an account that can manage DNS (for example, a member of Domain Admins or DnsAdmins).
  • Know the other domain name (for example contoso.com) and the IP addresses of at least one DNS server that is authoritative for it.
  • Make sure your DNS server can reach those IPs on port 53 (UDP and TCP). Check firewalls and the VPN.
Test first from the DNS server itself: nslookup server1.contoso.com 10.20.0.10 (using the other side's DNS IP). If that fails, the forwarder will fail too, so fix the network first.

Steps in DNS Manager

  1. On the DNS server, open Server Manager, then Tools > DNS. DNS Manager opens.
  2. In the left pane, expand your server name. You will see Forward Lookup Zones, Reverse Lookup Zones and Conditional Forwarders.
  3. Right-click Conditional Forwarders and choose New Conditional Forwarder...
  4. In DNS Domain, type the other domain, for example contoso.com.
  5. Under IP addresses of the master servers, click the box and type the IP of the other domain's DNS server, then press Enter. Windows tries to contact the server straight away. If it reports an error, stop and check the network before going further. Add a second server if there is one.
  6. If this is a domain controller and you want every DC to get the same forwarder, tick Store this conditional forwarder in Active Directory, and replicate it as follows and pick All DNS servers in this domain (or forest, if every domain in your forest needs it).
  7. Click OK. The new domain appears under Conditional Forwarders.
Don't create a conditional forwarder for your own Active Directory domain, and don't point one at a zone you already host. You can break name resolution for the whole domain. If you get a domain wrong, delete only the forwarder you just made: right-click it under Conditional Forwarders and choose Delete.

The PowerShell way

Run in an elevated PowerShell window on the DNS server. This stores the forwarder in the registry of this server only:

Add-DnsServerConditionalForwarderZone -Name "contoso.com" -MasterServers 10.20.0.10,10.20.0.11 -PassThru

On a domain controller, this stores it in Active Directory and replicates it to every DNS server on a DC in the domain. Other values for -ReplicationScope are Forest, Legacy and Custom:

Add-DnsServerConditionalForwarderZone -Name "contoso.com" -ReplicationScope "Domain" -MasterServers 10.20.0.10,10.20.0.11

To stop the server trying to resolve the name itself if the forwarder doesn't answer, there is a -UseRecursion switch, and -ForwarderTimeout sets the wait in seconds (0 to 15).

Check it worked

  1. In DNS Manager, click Conditional Forwarders. Your domain should be listed. Double-click it to see the server IPs.
  2. From a normal client PC that uses your DNS server, run nslookup server1.contoso.com. You should get the correct IP back, answered by your own DNS server.
  3. If you stored it in AD, wait for replication, then run the same test against another DC: nslookup server1.contoso.com dc2.
  4. If it fails, run ipconfig /flushdns on the client, then right-click the server in DNS Manager and choose Clear Cache, and test again.

Sources

← All tutorials
Esc