--- title: "Mastering AD DNS Forwarders and Conditional Forwarders" description: "Learn all about AD DNS forwarders, including DNS conditional forwarders, and manage them effectively." canonical: "https://adamtheautomator.com/dns-conditional-forwarder/" --- # Mastering AD DNS Forwarders and Conditional Forwarders > Learn all about AD DNS forwarders, including DNS conditional forwarders, and manage them effectively. Source: https://adamtheautomator.com/dns-conditional-forwarder/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Mastering AD DNS Forwarders and Conditional Forwarders](https://adamtheautomator.com/wp-content/uploads/2019/07/photo-1533163931393-b9ead36b047a.jpg) # Mastering AD DNS Forwarders and Conditional Forwarders [![](https://secure.gravatar.com/avatar/c7a74bc8c8cff3fbf86e12939764aae0a53a7207d518c3be47a8763a25c74245?s=192&d=mm&r=g)David Lamb](https://adamtheautomator.com/author/david/)26 July 20193 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/)[Microsoft DNS](/tag/microsoft-dns/) Table of Contents * [Replacing DNS Forwarders](#replacing-dns-forwarders) * [Removing DNS Forwarders](#removing-dns-forwarders) * [Scaling to Multiple DNS Servers](#scaling-to-multiple-dns-servers) * [DNS Conditional Forwarders](#conditional-forwarders) * [Summary](#summary) Windows DNS forwarders and DNS conditional forwarder are an important part of your DNS infrastructure. In this tutorial, we’re going to cover AD DNS forwarders and how you can manage them in your environment. Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** You will find that on occasion you need to add or manage these forwarder addresses. Some of these changes need to be made across multiple DNS servers in your enterprise. Thankfully, using commands like PowerShell’s `Set-DnsServerForwarder` cmdlet and others allow you to easily manage both of these DNS services with ease. > _This blog post has a companion video created by [TechSnips contributor, David Lamb](http://thefrozengeek.blogspot.com/). Feel free to have a watch or, if you prefer text, read on!_ ## Replacing DNS Forwarders DNS forwarders are used by a DNS server to lookup queries for addresses that aren’t contained in any zones that the server is authoritative for. This provides your DNS servers with an efficient means for resolving names. Without the forwarders in place, your DNS server would have to query the root hint servers to start resolving unknown addresses. While these forwarder addresses are configured separately on each DNS server, using PowerShell makes managing them a lot easier by allowing us to use the `Set-DnsServerForwarder` cmdlet. Begin by viewing the currently configured forwarders for the local [DNS](https://adamtheautomator.com/resolve-dnsname/) server. We’ll do this by using the `Get-DnsServerForwarder` cmdlet. We’re using the `Get-*` cmdlet first because you first need to find all existing forwarders. As seen below, there are two forwarders configured with IP addresses of 8.8.8.8 and 8.8.4.4. ```powershell PS> Get-DnsServerForwarder ``` ![Finding existing DNS server forwarders](https://adamtheautomator.com/wp-content/uploads/2020/07/TS-Demo-DNS-Forwarders-01-2-2.png) Finding existing DNS server forwarders Now add an additional forwarder. This forwarder could possibly a new DNS server that you have configured in our DMZ, or perhaps using a forwarding address provided by our ISP. In this case, you’ll use the `Set-DnsServerForwarder` cmdlet to set the new address and then use `Get-DnsServerForwarder` to confirm that the address was set correctly. ```powershell Set-DnsServerForwarder -IPAddress 192.168.1.1 Get-DnsServerForwarder ``` ![Confirming DNS server forwarder change](https://adamtheautomator.com/wp-content/uploads/2020/07/TS-Demo-DNS-Forwarders-02-1-.png) Confirming DNS server forwarder change Unfortunately, this did not have the desired outcome. As you can see above, using the `Set-DnsServerForwarder` cmdlet actually replaces the list of forwarders rather than adding to it. To add the address to the list, rather than replacing the entire list, you need to use `Add-DnsServerForwarder`. To correct this, replace the list with the original two forwarders, add the new address, then check to see if you are successful. ```powershell Set-DnsServerForwarder -IPAddress 8.8.8.8, 8.8.4.4 Add-DnsServerForwarder -IPAddress 192.168.1.1 Get-DnsServerForwarder ``` ![Confirming DNS server forwarder addition](https://adamtheautomator.com/wp-content/uploads/2020/07/TS-Demo-DNS-Forwarders-03-1-.png) Confirming DNS server forwarder addition You now have all three forwarders added. ## Removing DNS Forwarders Let’s say you want to remove a forwarder address, you would use the `Remove-DnsServerForwarder` cmdlet as shown below. Then, you’d check to see if the address has been removed. If `Set-DnsServerForwarder` replaces the DNS forwarder, `Remove-DnsServerForwarder` removes it completely. ```powershell Remove-DnsServerForwarder -IPAddress 192.168.1.1 Get-DnsServerForwarder ``` ![Confirming DNS server forwarder removal](https://adamtheautomator.com/wp-content/uploads/2020/07/TS-Demo-DNS-Forwarders-01-3-.png) Confirming DNS server forwarder removal ## Scaling to Multiple DNS Servers Sometimes, you will need to be able to add or remove a forwarder address on multiple DNS servers. In this instance, `Set-DnsServerForwarder` will not work. Thankfully PowerShell makes scaling this task to multiple DNS servers relatively easy. If you use [`Invoke-Command`](https://adamtheautomator.com/invoke-command/ "Invoke-Command"), include a list of all of our DNS servers, then put `Add-DnsServerForwarder` into the scriptblock parameter value, you can modify all of the DNS servers with a single command. Then using a similar command, view the results of our changes. ```powershell Invoke-Command -ComputerName DC01, DC02, DC03 -ScriptBlock { Add-DnsServerForwarder -IPAddress 192.168.1.1 } Invoke-Command -ComputerName DC01, DC02, DC03 -ScriptBlock { Get-DnsServerForwarder } ``` ![Adding DNS server forwarders on multiple DNS Servers](https://adamtheautomator.com/wp-content/uploads/2020/07/TS-Demo-DNS-Forwarders-04-1-.png) Adding DNS server forwarders on multiple DNS Servers ## DNS Conditional Forwarders A special type of forwarder, called a conditional forwarder, cannot be modified with the `Set-DnsServerForwarder` cmdlet. This type of forwarder can be used when you have been provided with the IP address(es) of the DNS server(s) for a known DNS domain name. DNS Conditional forwarders are used by the DNS server before using the server forwarders listed earlier in this article. For example, if you have a conditional forwarder configured for tailspintoys.com, your DNS server will, after checking that it isn’t a domain it is authoritative for, check the conditional forwarders and find that an entry exists. At this point, your DNS server queries the DNS server listed for the desired address in the tailspintoys.com domain. One nice feature of DNS conditional forwarders is that they can be replicated to other DNS servers in the same way that any Active Directory Integrated [DNS Zone](https://adamtheautomator.com/powershell-add-dns-zone/ "DNS Zone") can be. Start by checking to see if you have a conditional forwarder configured by using the `Get-DnsServerZone` cmdlet. ```powershell PS> Get-DnsServerZone ``` ![Finding DNS server zones](https://adamtheautomator.com/wp-content/uploads/2020/07/TS-Demo-DNS-Forwarders-05-1--1024x256.png) Finding DNS server zones Conditional forwarders show up in this list with a `ZoneType` of _forwarder_. In this case, we don’t have one configured. So, you will use `Add-DnsServerConditionalForwarderZone` to create the conditional forwarder, set it to replicate to the entire Active Directory forest, and then confirm it has been created. ```powershell PS> Add-DnsServerConditionalForwarderZone ` -Name tailspintoys.com ` -MasterServers 10.10.14.240,10.10.14.241 ` -ReplicationScope Forest PS> Get-DnsServerZone ``` ![Verifying new DNS server conditional forwarder zone](https://adamtheautomator.com/wp-content/uploads/2020/07/TS-Demo-DNS-Forwarders-06-1--1024x277.png) Verifying new DNS server conditional forwarder zone The output shows that you have our conditional forwarder configured, and it is ready to go. ## Summary PowerShell really does make managing DNS forwarders a snap! You should now be able to use PowerShell to manage and automate AD DNS forwarders many different ways. We covered these forwarder at just about every angle. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fdns-conditional-forwarder%2F&text=Mastering%20AD%20DNS%20Forwarders%20and%20Conditional%20Forwarders)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fdns-conditional-forwarder%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fdns-conditional-forwarder%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-11.webp) ### [How to Troubleshoot Active Directory Replication Errors](/troubleshoot-active-directory-replication-errors/) Troubleshoot Active Directory replication errors by isolating 1311, 1722, 2087, and USN rollback issues with repadmin, dcdiag, DNS, RPC, and KCC checks. ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-7.webp) ### [Migrate Group Policy to Intune Without Breaking Endpoints](/gpo-intune-migration/) Export GPOs as XML, analyze them with Group Policy Analytics, migrate supported settings to Intune Settings Catalog, and resolve hybrid device conflicts. ![](https://adamtheautomator.com/wp-content/uploads/2026/06/ditch-gpos-intune-featured.webp) ### [Ditch the GPOs: Migrate to Microsoft Intune](/ditch-gpos-migrate-microsoft-intune-2/) Use Group Policy Analytics to migrate GPOs to Intune Settings Catalog profiles, handle unsupported Group Policy Preferences, and manage hybrid AD-to-MDM transitions. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)