Windows Server DNS as a Hidden Primary

Keep your public zone on Windows Server DNS and let an external secondary answer the internet. Zone transfers, NOTIFY, and the Active Directory trap.

First: do not transfer your Active Directory zone

An Active Directory-integrated zone contains your internal network: the domain controllers, their addresses, and service records under _msdcs, _sites, and _tcp. A secondary on the internet answers every query for the zones it holds. If you hand it your AD zone, you publish that map of your network.

Use a separate zone for the public side:

  • Your AD domain is a subdomain (for example corp.example.ch): create example.ch as its own, file-backed zone and transfer only that one.
  • Your AD domain has the same name as your public domain (split-brain): a domain controller cannot hold a second zone with the same name. Put the public zone on a separate Windows server that is not a domain controller, and use that server as the hidden primary.

1. Create a file-backed primary zone

In DNS Manager, right-click Forward Lookup Zones and choose New Zone. Select Primary zone and clear the option to store the zone in Active Directory. Or in PowerShell:

PowerShell
PS> Add-DnsServerPrimaryZone -Name "example.ch" -ZoneFile "example.ch.dns" -DynamicUpdate None

Windows stores the file in %windir%\System32\dns. -DynamicUpdate None keeps clients on your network from registering their own records in the public zone.

2. Allow zone transfers to the secondary

Open the zone's Properties, tab Zone Transfers. Check Allow zone transfers, choose Only to the following servers, click Edit, and add the transfer addresses of your secondary. For hiddenprimary.ch:

  • 159.69.29.118 — transfer node
  • 45.131.252.44 — standby that takes over when the transfer node is unavailable

Add both. If you leave the standby out, your zone stops updating while the transfer node is unavailable. If you gave us an IPv6 address for your server, also add 2a01:4f8:1c0c:63c4::118 and 2a11:8b80:1000:1::18.

Do not choose Only to servers listed on the Name Servers tab. Microsoft documents a problem with that option on servers with several IP addresses: incremental transfers do not happen, and changes announced by NOTIFY do not arrive.

3. Send NOTIFY to the secondary

On the same tab, click Notify. Check Automatically notify, choose The following servers, and add the same two addresses. Windows then tells the secondary about every change at once, instead of waiting for the next refresh.

Both steps in PowerShell:

PowerShell
PS> Set-DnsServerPrimaryZone -Name "example.ch" `
  -SecureSecondaries TransferToSecureServers `
  -SecondaryServers 159.69.29.118,45.131.252.44 `
  -Notify NotifyServers `
  -NotifyServers 159.69.29.118,45.131.252.44
 
# check the result
PS> Get-DnsServerZone -Name "example.ch" | Format-List SecureSecondaries,SecondaryServers,Notify,NotifyServers

In DNS Manager, the Zone Transfers tab must now show Only to the following servers with both addresses.

4. No TSIG: add the zone without a key

Windows Server DNS offers no TSIG setting for zone transfers. Its secure updates use Kerberos (GSS-TSIG), and only inside Active Directory. Restrict transfers by IP address as shown above, and add the zone on hiddenprimary.ch without a TSIG key.

5. Point the NS records at the secondary

A new zone lists your Windows server as its only nameserver. Resolvers prefer the NS records inside your zone over the delegation at the registrar, so change them: on the Name Servers tab, add our nameservers and remove the Windows server. Then update the delegation at your registrar. The migration guide explains the order. Until both match, we report NS_MISSING_OURS or NS_INCOMPLETE_OURS.

6. Firewall

  • Inbound TCP port 53 from the transfer addresses. Zone transfers run over TCP.
  • Inbound UDP port 53 from the same addresses, for the SOA check.
  • Outbound UDP port 53 to the notify addresses.

The DNS role opens port 53 in Windows Defender Firewall. The firewall at the edge of your network needs the same rules.

Changes and serials

When you change a record in DNS Manager or with PowerShell, Windows raises the SOA serial and sends the NOTIFY by itself. If you edit the .dns file directly, raise the serial yourself and reload the zone with dnscmd /zonereload example.ch.

Check that it works

PowerShell
PS> Resolve-DnsName -Name www.example.ch -Type A -Server ns1.hiddenprimary.ch -DnsOnly

If the record does not arrive, see zone transfer errors. On Windows, the usual causes are a missing TCP rule at the edge firewall, or a transfer list that still points at the Name Servers tab.

DNSSEC

If you sign the zone on Windows, the transfer contains your signatures, and we serve them unchanged. You can also leave the zone unsigned and let us sign it. See DNSSEC signing on the secondary.

Next Steps