Internal DNS recursion loop after Root Hints corruption

Mayer Zaniel 40 Reputation points
2026-09-09T09:43:25.1666667+00:00

Internal DNS resolution suddenly stops across the enterprise.

Root Hints records are corrupted and point back to internal forwarders.

DNS servers enter a recursion loop, causing complete name‑resolution failure.

dnscmd /ResetRootHints

This command restores the default Root Hints file and clears invalid entries. Any other suggestions to fully stabilize DNS recursion ?

Windows for business | Windows 365 Enterprise
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Harry Phan 30,640 Reputation points Independent Advisor
    2026-09-09T10:56:00.1566667+00:00

    Hello Mayer,

    You’ve already taken the right first step with dnscmd /ResetRootHints to restore the default Cache.dns file under %systemroot%\System32\dns. To fully stabilize recursion, you need to ensure that the DNS servers are not re‑entering a loop through misconfigured forwarders or stale cached data. After resetting Root Hints, flush the server cache with dnscmd /ClearCache and restart the DNS service (net stop dns && net start dns). This clears any corrupted entries that may persist in memory.

    Next, verify that your forwarders are correctly defined. In the DNS Manager console, check the server properties under the Forwarders tab. Forwarders should point only to trusted upstream resolvers (typically public resolvers like 8.8.8.8 or your ISP’s DNS). Do not configure forwarders that point back to internal servers already relying on Root Hints, as that reintroduces recursion loops. If you rely solely on Root Hints, remove all forwarders entirely.

    Also confirm that the Root Hints file is intact. Open %systemroot%\System32\dns\Cache.dns and compare it against the official Microsoft defaults. If you suspect corruption, you can copy a clean version from another healthy DNS server or extract it from the Windows installation media.

    Finally, check event logs under Applications and Services Logs > DNS Server for Event IDs 7062 or 4015, which often indicate recursion or Active Directory integration issues. If you see repeated 7062 errors, it means the server is attempting to resolve queries against itself, which confirms a loop. Correcting the forwarders and Root Hints should eliminate that.

    Once these steps are complete, monitor resolution with nslookup against external domains to confirm the recursion path is stable. If you continue to see failures, disable recursion temporarily (dnscmd /Config /NoRecursion 1) to isolate the issue, then re‑enable once the upstream path is corrected.

    I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!HP.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-09-09T09:43:48.5333333+00:00

    After restoring Root Hints, stabilize recursion by validating the full recursion path and removing any remaining circular dependency.

    1. Check whether the affected DNS servers are using forwarders.
      • In DNS Manager, open the server Properties and inspect the Forwarders tab.
      • If Enable forwarders is selected, verify the listed forwarders are valid and not pointing back into the same recursive path.
      • If one DNS server forwards to another, trace that chain server by server until the final resolver.
    2. Test whether the server can query root servers directly. Run: 
         nslookup
   server <IP address of server being examined>
   set q=NS
      • If this returns a root server IP address, recursion is reaching the root and the next likely issue is a broken delegation.
      • If it returns Request to server timed out, verify root hints and basic network reachability to the root servers.
    3. Verify the current Root Hints configuration.
      • Open the DNS console.
      • Connect to the affected DNS server.
      • Right-click the server, select Properties, then open Root Hints.
      • Confirm the entries are present and not pointing to internal servers.
    4. Check connectivity from the DNS server to root servers.
      • Test whether the DNS server can ping the root servers by IP address.
      • If root hints are correct but root servers are unreachable, investigate network path issues or firewall rules that could block recursive lookups.
    5. Test for broken delegation if recursion now reaches the root but resolution still fails. Run: 
         nslookup
   server <server IP address>
   set norecursion
   set querytype= <resource record type>
   <FQDN>
      • If the response does not contain an NS record, the delegation is broken.
      • If NS records exist but corresponding A records do not, query for the A records individually. Missing valid IPs for delegated name servers indicates a broken delegation.
      • Fix broken delegation by adding or updating the A record in the parent zone with the correct IP address for the delegated DNS server.
    6. Validate forwarder and root-hint design.
      • If no conditional forwarder exists for the affected domain, check general forwarders.
      • Verify UseRootHints is enabled when forwarders are configured.
      • If neither forwarders nor root hints are configured correctly, external name resolution is expected to fail.
    7. If the server does not need recursion, disable it.
      • In DNS console, open server Properties > Advanced.
      • Turn on Disable recursion.
      • This also disables forwarders.
      • Use this only where recursion is not required, because it changes name-resolution behavior for that server.
    8. Confirm the DNS service is healthy on both forwarding and forwarder servers. Run: 
         Get-Service -Name DNS
      Start it if needed: 
         Start-Service -Name DNS
    9. Verify DNS transport is not being blocked.
      • Ensure UDP port 53 is allowed between clients and DNS servers.
      • Ensure UDP port 53 is also allowed between forwarding DNS servers and their forwarders.
    10. If failures continue, collect packet traces after clearing client cache. Run on the client first:
    ipconfig /flushdns

    Then capture DNS traffic to confirm whether queries are looping, timing out, or failing upstream.

    A practical stabilization approach is:

    • restore Root Hints,
    • verify forwarders are not circular,
    • confirm root-server reachability,
    • test recursion with nslookup,
    • fix any broken delegations,
    • disable recursion on servers that should not perform it.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.