Windows Server / Active Directory & Group Policy
Compare AD-integrated DNS zone scope with intended visibility
A record can appear on one DNS server and be absent from another because zone replication scope or AD replication differs.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-DnsServerZone -ComputerName DC01 | Select-Object ZoneName, ZoneType, IsDsIntegrated, ReplicationScopeRead the result
With DNS Server management tools, the query reports zones and their integration properties on the selected server.
Resolve and verify
Compare the affected zone's intended scope and replication partners, then investigate AD replication before adding duplicate zones. Verify the same record through the relevant resolvers after correction.
Before changing production
Do not create a competing primary zone to mask an AD-integrated replication failure.