Windows Server / Active Directory & Group Policy
Check domain-controller DNS prerequisites without changing records
AD service discovery depends on the correct DNS path. A controller using inappropriate resolvers can cause replication and logon failures.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
dcdiag /s:DC01 /test:DNS /DnsBasic /vRead the result
With DCDiag available, the basic DNS test reports resolver and service-related checks for the selected controller. It is one part of AD health, not a full replication certification.
Resolve and verify
Compare resolver configuration with the approved AD DNS design and inspect the exact failed test. Correct the specific DNS dependency and repeat targeted discovery and replication checks.
Before changing production
Use authorized domain context. Do not replace domain DNS with public resolvers on a controller.