<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=1678611822423757&amp;ev=PageView&amp;noscript=1">
Defrag This

| Read. Reflect. Reboot.

Manage DNS Zones with PowerShell

Adam Bertram| April 11 2017

| IT insights


managing-dns-zones-with-powershell.jpgIf you find yourself making changes on your Microsoft DNS servers using the DNS MMC snapin you're probably wasting a lot of time.

Why? Because it's possible to create, modify or remove any DNS object that you can from the MMC with PowerShell! By using PowerShell to manage DNS allows you not only control things from the command line but to take those commands and put them into a script to automate all kinds of time-consuming tasks.

To limit this article's scope, we're going to just focus on managing DNS zones with PowerShell although it's completely possible to administer other DNS objects like records and the server itself as well.

Before we get too far, there are a few prerequisites you need to be aware of. First, I'm assuming you have permissions to read, modify and remove DNS zones from your Windows DNS servers. Second, I'll be demonstrating a few concepts from DNS servers that are in an Active Directory domain with AD-integrated zones. PowerShell is still capable of managing zones and records outside of Active Directory but may not quite be the same result as I'll be showing you here. Finally, you'll need to ensure you have a version of the Remote Server Administration Tools (RSAT) installed on your client specific to your operating system.

Now that we have that out of the way let's start out by first ensuring the DNSServer module is available to us. To do that, I'll use the Get-Module cmdlet.

PS C:\> Get-Module DnsServer -ListAvailable

    Directory: C:\Windows\system32\WindowsPowerShell\v1.0\Modules

ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Manifest    DnsServer                           {Add-DnsServerConditionalForwarderZone, Add-DnsServerDirectoryPartition, Add-DnsServerForwarder, Add-DnsServerPrimaryZone...}

Great! It looks like our module is downloaded and we have some available commands. Let's now see what commands we have to work with DNS zones.

PS C:\> Get-Command -Module DnsServer -Noun *Zone*

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Function        Add-DnsServerConditionalForwarderZone        DnsServer
Function        Add-DnsServerPrimaryZone                     DnsServer
Function        Add-DnsServerSecondaryZone                   DnsServer
Function        Add-DnsServerStubZone                        DnsServer
Function        Add-DnsServerZoneDelegation                  DnsServer
Function        Add-DnsServerZoneScope                       DnsServer
Function        Add-DnsServerZoneTransferPolicy              DnsServer
Function        ConvertTo-DnsServerPrimaryZone               DnsServer
Function        ConvertTo-DnsServerSecondaryZone             DnsServer
Function        Export-DnsServerZone                         DnsServer
Function        Get-DnsServerDnsSecZoneSetting               DnsServer
Function        Get-DnsServerGlobalNameZone                  DnsServer
Function        Get-DnsServerZone                            DnsServer
Function        Get-DnsServerZoneAging                       DnsServer
Function        Get-DnsServerZoneDelegation                  DnsServer
Function        Get-DnsServerZoneScope                       DnsServer
Function        Get-DnsServerZoneTransferPolicy              DnsServer
Function        Invoke-DnsServerZoneSign                     DnsServer
Function        Invoke-DnsServerZoneUnsign                   DnsServer
Function        Remove-DnsServerZone                         DnsServer
Function        Remove-DnsServerZoneDelegation               DnsServer
Function        Remove-DnsServerZoneScope                    DnsServer
Function        Remove-DnsServerZoneTransferPolicy           DnsServer
Function        Reset-DnsServerZoneKeyMasterRole             DnsServer
Function        Restore-DnsServerPrimaryZone                 DnsServer
Function        Restore-DnsServerSecondaryZone               DnsServer
Function        Resume-DnsServerZone                         DnsServer
Function        Set-DnsServerConditionalForwarderZone        DnsServer
Function        Set-DnsServerDnsSecZoneSetting               DnsServer
Function        Set-DnsServerGlobalNameZone                  DnsServer
Function        Set-DnsServerPrimaryZone                     DnsServer
Function        Set-DnsServerSecondaryZone                   DnsServer
Function        Set-DnsServerStubZone                        DnsServer
Function        Set-DnsServerZoneAging                       DnsServer
Function        Set-DnsServerZoneDelegation                  DnsServer
Function        Set-DnsServerZoneTransferPolicy              DnsServer
Function        Start-DnsServerZoneTransfer                  DnsServer
Function        Suspend-DnsServerZone                        DnsServer
Function        Sync-DnsServerZone                           DnsServer
Function        Test-DnsServerDnsSecZoneSetting              DnsServer

First up, let's create a zone with PowerShell. To do this, we'll use the Add-DnsServerPrimaryZone function. The simplest way this can be done is by using two parameters. Those parameters are Name and ReplicationScope. However, in our example, I'll also be using the ComputerName parameter since I'm invoking this command on a remote computer.

Add-DnsServerPrimaryZone -Name testzone.mylab.local -ComputerName DC -ReplicationScope Forest

Above you can see that my domain is mylab.local and my zone name is testzone. My DNS server is DC so I'm specifying that for the ComputerName parameter and finally since this server is on my domain I have to also set the ReplicationScope so I've chosen to replicate this zone amongst all other DNS servers in my Active Directory forest.

Next, to verify this zone was created, I can then use the Get-DnsServerZone command. I could use the Name parameter but to show you all of the zones I have I'll just tell Get-DnsServerZone to find all of them.

PS C:\> Get-DnsServerZone -ComputerName DC

ZoneName                            ZoneType        IsAutoCreated   IsDsIntegrated  IsReverseLookupZone  IsSigned
--------                            --------        -------------   --------------  -------------------  --------
_msdcs.mylab.local                  Primary         False           True            False                False
0.in-addr.arpa                      Primary         True            False           True                 False
127.in-addr.arpa                    Primary         True            False           True                 False
255.in-addr.arpa                    Primary         True            False           True                 False
mylab.local                         Primary         False           True            False                False
testzone.mylab.local                Primary         False           True            False                False
TrustAnchors                        Primary         False           True            False                False

And just to be sure we go through the entire lifecycle of a DNS zone, I'll then remove it.

PS C:\> Remove-DnsServerZone -Name testzone.mylab.local -ComputerName DC


This will also remove all the records in the zone, and the server will no longer host the zone, do you want to continue?

[Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"): y
PS C:\> Get-DnsServerZone -ComputerName DC

ZoneName                            ZoneType        IsAutoCreated   IsDsIntegrated  IsReverseLookupZone  IsSigned
--------                            --------        -------------   --------------  -------------------  --------
_msdcs.mylab.local                  Primary         False           True            False                False
0.in-addr.arpa                      Primary         True            False           True                 False
127.in-addr.arpa                    Primary         True            False           True                 False
255.in-addr.arpa                    Primary         True            False           True                 False
mylab.local                         Primary         False           True            False                False
TrustAnchors                        Primary         False           True            False                False

There is so much more possible with managing DNS zones in PowerShell. I encourage you to look through all of the commands possible in Get-Command -Module DnsServer -Noun *Zone*. This command gives you a list of all of the commands inside of the DnsServer module that have 'Zone' in the name. You'll find that the command names are self-explanatory and if you need to investigate further always consult the help of each command using Get-Help.

New Call-to-action

Topics: IT insights

Leave a Reply

Your email address will not be published. Required fields are marked *


Adam Bertram is a 20-year veteran of IT. He’s currently an automation engineer, blogger, independent consultant, freelance writer, author, and trainer. Adam focuses on DevOps, system management, and automation technologies as well as various cloud platforms. He is a Microsoft Cloud and Datacenter Management MVP and efficiency nerd that enjoys teaching others a better way to leverage automation.

Free Trials

Getting started has never been easier. Download a trial today.

Download Free Trials

Contact Us

Let us know how we can help you. Focus on what matters. 

Send us a note

Subscribe to our Blog

Let’s stay in touch! Register to receive our blog updates.