Rebuilding DNS policy scopes in Windows Server.

Question

Rebuilding DNS policy scopes in Windows Server.

Dull Pretty 0

The issue relates to internal DNS policies configured to return specific IP addresses based on client subnet masks.

The resolution process fails to operate as intended, persistently returning default gateway IP addresses rather than the designated subnet records.

An inspection reveals that ClientSubnetRecord objects were improperly linked within the zone configuration, causing incoming queries to fall back to default entries instead of matching the intended scope.

In what manner can we rebuild and correctly associate the DNS policy scopes in this scenario?

0 comments

1 answer

Your answer

Answer 1

Hello Dull Pretty,

The issue is that your DNS policies are not correctly bound to the client subnet objects, so queries fall back to the default gateway records. The proper way to rebuild them is to first remove the broken policies from the zone with Remove-DnsServerQueryResolutionPolicy -Name <PolicyName> -ZoneName <ZoneName>. Then recreate the client subnet definitions using Add-DnsServerClientSubnet -Name <SubnetName> -IPv4Subnet <CIDR>. After that, ensure your zone scopes are defined with Add-DnsServerZoneScope -ZoneName <ZoneName> -Name <ScopeName> and that the intended resource records exist inside those scopes. Finally, re‑associate the subnet objects with the zone scopes by creating new policies: Add-DnsServerQueryResolutionPolicy -Name <PolicyName> -Action ALLOW -ZoneScope <ScopeName> -ClientSubnet <SubnetName>. Once rebuilt, verify with Get-DnsServerQueryResolutionPolicy and test queries from each subnet to confirm the correct IPs are returned instead of the default entries.

If my answer is useful for you, please hit Accept the answer to support me.

Thank you,

HL.