Windows DNS Server Konfiguration Zonen 2025

DNS Rolle installieren

# DNS Server installieren
Install-WindowsFeature -Name DNS -IncludeManagementTools

# DNS-Verwaltung
dnsmgmt.msc  # GUI
Get-DnsServer  # PowerShell

Primary Zone erstellen

# Neue primaere Zone
Add-DnsServerPrimaryZone `
    -Name "firma.local" `
    -ZoneFile "firma.local.dns" `
    -DynamicUpdate None

# AD-integrierte Zone (bevorzugt in AD-Umgebungen!)
Add-DnsServerPrimaryZone `
    -Name "firma.local" `
    -ReplicationScope Domain `
    -DynamicUpdate Secure

# Reverse-Lookupzone
Add-DnsServerPrimaryZone `
    -NetworkId "192.168.1.0/24" `
    -ReplicationScope Domain

# Zone anzeigen
Get-DnsServerZone

DNS-Records erstellen

# A-Record (Host)
Add-DnsServerResourceRecordA `
    -ZoneName "firma.local" `
    -Name "webserver" `
    -IPv4Address "192.168.1.10"

# CNAME (Alias)
Add-DnsServerResourceRecordCName `
    -ZoneName "firma.local" `
    -Name "www" `
    -HostNameAlias "webserver.firma.local."

# MX (Mail)
Add-DnsServerResourceRecordMX `
    -ZoneName "firma.local" `
    -Name "@" `
    -MailExchange "mail.firma.local" `
    -Preference 10

# SRV (Service Record, z.B. fuer VOIP)
Add-DnsServerResourceRecord `
    -ZoneName "firma.local" `
    -Srv `
    -Name "_sip._tcp" `
    -DomainName "sip.firma.local" `
    -Port 5060 `
    -Priority 0 `
    -Weight 0

# Alle Records einer Zone anzeigen
Get-DnsServerResourceRecord -ZoneName "firma.local"

Forwarder konfigurieren

# Root-Hints durch Forwarder ersetzen (empfohlen)
Set-DnsServerForwarder -IPAddress "9.9.9.9", "1.1.1.1" -UseRootHint $false

# Conditional Forwarder (fuer Partner-Netzwerke)
# Alle *.partner.local Anfragen an deren DNS
Add-DnsServerConditionalForwarderZone `
    -Name "partner.local" `
    -MasterServers "192.168.2.10" `
    -ReplicationScope Domain

# Forwarder anzeigen
Get-DnsServerForwarder

# Conditional Forwarder anzeigen
Get-DnsServerZone | Where-Object {$_.ZoneType -eq "Forwarder"}

DNS-Diagnose

# DNS-Aufloesung testen
Resolve-DnsName -Name "webserver.firma.local" -Server "192.168.1.1"
nslookup webserver.firma.local 192.168.1.1

# DNS-Cache
Get-DnsClientCache | Where-Object {$_.Entry -like "*firma*"}
Clear-DnsClientCache

# DNS-Fehler suchen
dnslint /test_tcp  # DNS-TCP-Test
dcdiag /test:dns   # AD-DNS Diagnose

# Event-Log
Get-EventLog -LogName "DNS Server" -Newest 20

# DNS-Statistiken
Get-DnsServerStatistics

DNS-Sicherheit (DNSSEC)

# DNSSEC fuer interne Zone aktivieren (optional)
Invoke-DnsServerZoneSign `
    -ZoneName "firma.local" `
    -CryptoAlgorithm RsaSha256 `
    -KeyLength 2048 `
    -SignWithDefault

# DNSSEC-Status
Get-DnsServerZone -Name "firma.local" | Select-Object IsSigned

FAQ

Wie viele DNS-Server braucht ein KMU?
Mindestens 2 DNS-Server (beide Domain Controller sollten DNS-Rolle haben). Single-Point-of-Failure vermeiden.

Fazit

Windows DNS ist stark in AD integriert: Dynamic Updates registrieren Clients automatisch, Conditional Forwarder verbinden Netzwerke, Diagnosetooling ist ausfuehrlich.

Windows DNS und Active Directory fuer KMU in Heidelberg, Mannheim und der Rhein-Neckar-Region. Beratung anfragen.

Windows DNS Server – Zonen und Records konfigurieren 2025