How to Change DNS on Microsoft Active Directory (Windows Server DNS)
By [FILL IN], [FILL IN] · Last updated
In an Active Directory domain, clients must keep using your domain controllers for DNS so logons and Group Policy work. Instead of changing the clients, point the DNS forwarders on every domain controller to FirewallDNS. Internal AD zones still resolve locally, and every external lookup is filtered.
Before you start
You need a FirewallDNS account (see pricing). Sign in to your dashboard, register your public IP address and copy your DNS server addresses. Replace <FIREWALLDNS-PRIMARY> and <FIREWALLDNS-SECONDARY> below with them.
Step by step
- Register the public IP address of your office in the FirewallDNS dashboard.
- Sign in to a domain controller and open Server Manager > Tools > DNS (dnsmgmt.msc).
- Right-click the server name and choose Properties.
- Open the Forwarders tab and click Edit.
- Remove existing forwarders (ISP or public resolvers) and add <FIREWALLDNS-PRIMARY> and <FIREWALLDNS-SECONDARY>. Click OK.
- Clear "Use root hints if no forwarders are available" so lookups cannot bypass the filter.
- Click Apply. Repeat on every domain controller running DNS, or use the PowerShell below.
- Check Conditional Forwarders: keep only those that point to internal or partner domains.
- Flush the server cache: right-click the server > Clear Cache.
PowerShell (run on each DC, or loop over all DCs)
# Replace forwarders on this DC
Set-DnsServerForwarder -IPAddress "<FIREWALLDNS-PRIMARY>","<FIREWALLDNS-SECONDARY>" -UseRootHint $false
# Apply to every domain controller in the domain
Get-ADDomainController -Filter * | ForEach-Object {
Set-DnsServerForwarder -ComputerName $_.HostName -IPAddress "<FIREWALLDNS-PRIMARY>","<FIREWALLDNS-SECONDARY>" -UseRootHint $false
}
# Verify
Get-DnsServerForwarder
Clear-DnsServerCache -Force
Resolve-DnsName example.com -Server localhostGood to know
- Never point domain-joined clients directly at an external resolver: AD SRV records will fail.
- Block outbound UDP/TCP 53 from clients at the firewall so only domain controllers can reach the internet for DNS.
- The FirewallDNS log will show the domain controller IP for all lookups. Use DNS debug logging on the DC to map lookups back to clients.
Verify it works
- Renew DHCP on a client (Windows:
ipconfig /renew, macOS: reconnect Wi-Fi). - Run
nslookup example.comand check which server answered. - Open the live log in your dashboard. New lookups should appear within seconds.