Windows Server 2012 : Troubleshooting DNS (part 2) – Using the DNSCmd Command-Line Utility, Managing DNS with PowerShell

Using the Ipconfig Command-Line Utility

Another important tool for DNS resolution problems is the Ipconfig utility, the same utility used for common TCP/IP issues. There are several key functions that Ipconfig offers with regard to DNS. These functions can be invoked from the command prompt with the right parameter, detailed as follows:

• ipconfig /flushdns—If you experience problems with the client-side cache, the cache itself can be “flushed” through the invocation of the flushdns flag. This removes all previously cached queries that a client might be storing and is particularly useful if a server name has just changed IP addresses and particular clients have trouble connecting to it.

• ipconfig /registerdns—The registerdns flag forces the client to dynamically reregister itself in DNS, if the particular zone supports dynamic updates.

• ipconfig /displaydns—An interesting but not well-known parameter is displaydns. This flag displays the contents of the client-side cache and is useful for troubleshooting specific issues with individual records.

Using the Tracert Command-Line Utility

The Tracert utility is a valuable resource that gives you an idea of the path that a DNS query takes when being sent over a network. By directing Tracert at, for example, you can get an idea of how many routers and DNS servers the packet is crossing. The way that Tracert works is simple, but actually quite interesting. A DNS query that has a TTL of 1 is sent out. Because all routers are supposed to drop the TTL by 1 on each packet that they process, this means that the first router will refuse to forward the packet and send that refusal back to the originator. The originating machine then increments the TTL by 1 and resends the packet. This time the packet will make it past the first router and get refused by the second. This process continues until the destination is met. Needless to say, using this command-line utility is a simple yet effective way of viewing the path that a DNS query takes as it crosses the Internet.

Using the DNSCmd Command-Line Utility

The DNSCmd utility is essentially a command-line version of the DNS Manager console. Installed as part of the Windows Server 2012 DNS Server role, this utility enables administrators to create zones, modify records, and perform other vital administrative functions via the command line. You can view the full functionality of this utility by typing dnscmd /? at the command line, as illustrated in Listing 2.

Listing 2. DNSCMD Command Options

Usage: DnsCmd <ServerName> <Command> [<Command Parameters>]

IP address or host name    — remote or local DNS server
.                          — DNS server on local machine
/Info                      — Get server information
/Config                    — Reset server or zone configuration
/EnumZones                 — Enumerate zones
/Statistics                — Query/clear server statistics data
/ClearCache                — Clear DNS server cache
/WriteBackFiles            — Write back all zone or root-hint datafile(s)
/StartScavenging           — Initiates server scavenging
/IpValidate                — Validate remote DNS servers
/EnumKSPs                  — Enumerate available key storage providers
/ResetListenAddresses      — Set server IP address(es) to serve DNS requests
/ResetForwarders           — Set DNS servers to forward recursive queries to
/ZoneInfo                  — View zone information
/ZoneAdd                   — Create a new zone on the DNS server
/ZoneDelete                — Delete a zone from DNS server or DS
/ZonePause                 — Pause a zone
/ZoneResume                — Resume a zone
/ZoneReload                — Reload zone from its database (file or DS)
/ZoneWriteBack             — Write back zone to file
/ZoneRefresh               — Force refresh of secondary zone from master
/ZoneUpdateFromDs          — Update a DS integrated zone by data from DS
/ZonePrint                 — Display all records in the zone
/ZoneResetType             — Change zone type
/ZoneResetSecondaries      — Reset secondary\notify information for a zone
/ZoneResetScavengeServers  — Reset scavenging servers for a zone
/ZoneResetMasters          — Reset secondary zone’s master servers
/ZoneExport                — Export a zone to file
/ZoneChangeDirectoryPartition — Move a zone to another directory partition
/ZoneSeizeKeymasterRole    — Seize the key master role for a zone
/ZoneTransferKeymasterRole — Transfer the key master role for a zone
/ZoneEnumSKDs              — Enumerate the signing key descriptors for a zone
/ZoneAddSKD                — Create a new signing key descriptor for a zone
/ZoneDeleteSKD             — Delete a signing key descriptor for a zone
/ZoneModifySKD             — Modify a signing key descriptor for a zone
/ZoneValidateSigningParameters — Validate DNSSEC online signing parameters for a
/ZoneSetSKDState           — Set Active and/or Standby keys for a signing key
descriptor for a zone
/ZoneGetSKDState           — Retrieve dynamic state for a signing key descriptor
for a zone
/ZonePerformKeyRollover    — Trigger a key rollover in a signing key descriptor
for a zone
/ZonePokeKeyRollover       — Trigger a key rollover in a signing key descriptor
for a zone
/ZoneSign                  — Signs the zone using DNSSEC online signing parameters

/ZoneUnsign                — Removes DNSSEC signatures from a signed zone
/ZoneResign                — Regenerate DNSSEC signatures in a signed zone
/EnumRecords               — Enumerate records at a name
/RecordAdd                 — Create a record in zone or RootHints
/RecordDelete              — Delete a record from zone, RootHints or cache
/NodeDelete                — Delete all records at a name
/AgeAllRecords             — Force aging on node(s) in zone
/TrustAnchorAdd            — Create a new trust anchor zone on the DNS server
/TrustAnchorDelete         — Delete a trust anchor zone from DNS server or DS
/EnumTrustAnchors          — Display status information for trust anchors
/TrustAnchorsResetType     — Change zone type for a trust anchor zone
/EnumDirectoryPartitions   — Enumerate directory partitions
/DirectoryPartitionInfo    — Get info on a directory partition
/CreateDirectoryPartition  — Create a directory partition
/DeleteDirectoryPartition  — Delete a directory partition
/EnlistDirectoryPartition  — Add DNS server to partition replication scope
/UnenlistDirectoryPartition — Remove DNS server from replication scope
/CreateBuiltinDirectoryPartitions — Create built-in partitions
/ExportSettings            — Output settings to DnsSettings.txt in the DNS server
database directory
/OfflineSign               — Offline signing zone files, including key genera-
/EnumTrustPoints           — Display active refresh information for all trust
/ActiveRefreshAllTrustPoints — Perform an active refresh on all trust points now
/RetrieveRootTrustAnchors  — Retrieve root trust anchors via HTTPS

<Command Parameters>:
DnsCmd <CommandName> /? — For help info on specific Command

In future versions of Windows, Microsoft might remove dnscmd.exe.

If you currently use dnscmd.exe to configure and manage the DNS server, Microsoft recommends that you transition to Windows PowerShell.

To view a list of commands for DNS server management, type Get-Command -Module DnsServer at the Windows PowerShell prompt. Additional information about Windows PowerShell commands for DNS is available at

Managing DNS with PowerShell

The PowerShell cmdlets are essentially a command-line version of the DNS Manager console. Installed as part of the Windows Server 2012 DNS Server role, this PowerShell module enables administrators to create zones, modify records, and perform other vital administrative functions via the command line exactly as can be done with the traditional DNSCmd tool. DNS configuration and management automation is greatly enhanced with Windows PowerShell, including the following:

• Feature parity with the user interface and DNSCmd.

• DNS Server role installation/removal using Windows PowerShell.

• Windows PowerShell client query with DNSSEC validation results.

• Server configuration is enabled for computers running older operating systems.

You can view the full functionality of this utility by typing Get-Command -Module DnsServer at the PowerShell command line, as shown in Listing 3.

Listing 3. PowerShell DNS Cmdlets

CommandType     Name                                               ModuleName
———–     —-                                               ———-
Alias           Export-DnsServerTrustAnchor                        DnsServer
Function        Add-DnsServerConditionalForwarderZone              DnsServer
Function        Add-DnsServerDirectoryPartition                    DnsServer
Function        Add-DnsServerForwarder                             DnsServer
Function        Add-DnsServerPrimaryZone                           DnsServer
Function        Add-DnsServerResourceRecord                        DnsServer
Function        Add-DnsServerResourceRecordA                       DnsServer
Function        Add-DnsServerResourceRecordAAAA                    DnsServer
Function        Add-DnsServerResourceRecordCName                   DnsServer
Function        Add-DnsServerResourceRecordDnsKey                  DnsServer
Function        Add-DnsServerResourceRecordDS                      DnsServer
Function        Add-DnsServerResourceRecordMX                      DnsServer
Function        Add-DnsServerResourceRecordPtr                     DnsServer
Function        Add-DnsServerRootHint                              DnsServer
Function        Add-DnsServerSecondaryZone                         DnsServer
Function        Add-DnsServerSigningKey                            DnsServer
Function        Add-DnsServerStubZone                              DnsServer
Function        Add-DnsServerTrustAnchor                           DnsServer
Function        Add-DnsServerZoneDelegation                        DnsServer
Function        Clear-DnsServerCache                               DnsServer
Function        Clear-DnsServerStatistics                          DnsServer
Function        ConvertTo-DnsServerPrimaryZone                     DnsServer
Function        ConvertTo-DnsServerSecondaryZone                   DnsServer
Function        Disable-DnsServerSigningKeyRollover                DnsServer
Function        Enable-DnsServerSigningKeyRollover                 DnsServer
Function        Export-DnsServerDnsSecPublicKey                    DnsServer
Function        Export-DnsServerZone                               DnsServer
Function        Get-DnsServer                                      DnsServer
Function        Get-DnsServerCache                                 DnsServer
Function        Get-DnsServerDiagnostics                           DnsServer
Function        Get-DnsServerDirectoryPartition                    DnsServer
Function        Get-DnsServerDnsSecZoneSetting                     DnsServer
Function        Get-DnsServerDsSetting                             DnsServer
Function        Get-DnsServerEDns                                  DnsServer
Function        Get-DnsServerForwarder                             DnsServer
Function        Get-DnsServerGlobalNameZone                        DnsServer
Function        Get-DnsServerGlobalQueryBlockList                  DnsServer
Function        Get-DnsServerRecursion                             DnsServer
Function        Get-DnsServerResourceRecord                        DnsServer
Function        Get-DnsServerRootHint                              DnsServer
Function        Get-DnsServerScavenging                            DnsServer
Function        Get-DnsServerSetting                               DnsServer
Function        Get-DnsServerSigningKey                            DnsServer
Function        Get-DnsServerStatistics                            DnsServer
Function        Get-DnsServerTrustAnchor                           DnsServer
Function        Get-DnsServerTrustPoint                            DnsServer
Function        Get-DnsServerZone                                  DnsServer
Function        Get-DnsServerZoneAging                             DnsServer
Function        Get-DnsServerZoneDelegation                        DnsServer
Function        Import-DnsServerResourceRecordDS                   DnsServer
Function        Import-DnsServerRootHint                           DnsServer
Function        Import-DnsServerTrustAnchor                        DnsServer
Function        Invoke-DnsServerSigningKeyRollover                 DnsServer
Function        Invoke-DnsServerZoneSign                           DnsServer
Function        Invoke-DnsServerZoneUnsign                         DnsServer
Function        Register-DnsServerDirectoryPartition               DnsServer
Function        Remove-DnsServerDirectoryPartition                 DnsServer
Function        Remove-DnsServerForwarder                          DnsServer
Function        Remove-DnsServerResourceRecord                     DnsServer
Function        Remove-DnsServerRootHint                           DnsServer
Function        Remove-DnsServerSigningKey                         DnsServer
Function        Remove-DnsServerTrustAnchor                        DnsServer
Function        Remove-DnsServerZone                               DnsServer
Function        Remove-DnsServerZoneDelegation                     DnsServer
Function        Reset-DnsServerZoneKeyMasterRole                   DnsServer
Function        Restore-DnsServerPrimaryZone                       DnsServer
Function        Restore-DnsServerSecondaryZone                     DnsServer
Function        Resume-DnsServerZone                               DnsServer
Function        Set-DnsServer                                      DnsServer
Function        Set-DnsServerCache                                 DnsServer
Function        Set-DnsServerConditionalForwarderZone              DnsServer
Function        Set-DnsServerDiagnostics                           DnsServer
Function        Set-DnsServerDnsSecZoneSetting                     DnsServer
Function        Set-DnsServerDsSetting                             DnsServer
Function        Set-DnsServerEDns                                  DnsServer
Function        Set-DnsServerForwarder                             DnsServer
Function        Set-DnsServerGlobalNameZone                        DnsServer
Function        Set-DnsServerGlobalQueryBlockList                  DnsServer
Function        Set-DnsServerPrimaryZone                           DnsServer
Function        Set-DnsServerRecursion                             DnsServer
Function        Set-DnsServerResourceRecord                        DnsServer
Function        Set-DnsServerResourceRecordAging                   DnsServer
Function        Set-DnsServerRootHint                              DnsServer
Function        Set-DnsServerScavenging                            DnsServer
Function        Set-DnsServerSecondaryZone                         DnsServer
Function        Set-DnsServerSetting                               DnsServer
Function        Set-DnsServerSigningKey                            DnsServer
Function        Set-DnsServerStubZone                              DnsServer
Function        Set-DnsServerZoneAging                             DnsServer
Function        Set-DnsServerZoneDelegation                        DnsServer
Function        Show-DnsServerCache                                DnsServer
Function        Show-DnsServerKeyStorageProvider                   DnsServer
Function        Start-DnsServerScavenging                          DnsServer
Function        Start-DnsServerZoneTransfer                        DnsServer
Function        Suspend-DnsServerZone                              DnsServer
Function        Sync-DnsServerZone                                 DnsServer
Function        Test-DnsServer                                     DnsServer
Function        Test-DnsServerDnsSecZoneSetting                    DnsServer
Function        Unregister-DnsServerDirectoryPartition             DnsServer
Function        Update-DnsServerTrustPoint                         DnsServer

Windows Server 2012 : Troubleshooting DNS (part 1) – Using the DNS Event Viewer to Diagnose Problems, Using the Nslookup Command-Line Utility