Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We would like to delete all the unused resource records from our authoritative nameserver (Windows DNS server on Win2k3). This is an internet facing DNS (not integrated with domain controller) so the aging and scavenging options are not available.

Basically I would like to delete everything that hasn't been requested for 2 months. I can only think of enabling some logging (on the DNS software itself) in order to log all requests. Then after two months I'll parse the log and do a kind of "diff" with the raw zone file in order to figure out the difference and delete the records not present in the log.

My question is whether or not there a better way or tool available to accomplish this?

share|improve this question

We took a non-technical approach to managing stale records. We made a list of all the records and built a spreadsheet with columns like name, IP, owner, last review & comments. We then passed that around to anyone who has system mgmt responsibilities asking them to claim ownership of their records and identify anything that was no longer needed.

Once we had that list, we removed anything that the owners said was not needed and we looked very closely at those with no owner. Most of them could be deleted. Depending on your role and the risk you can absorb, you could take a draconian approach to those unclaimed items. Just remember to save the details before deleting anything.

We now review that every year and update the review date. There could still be extra things in the database, but it is getting better

share|improve this answer
We did something like this ourselves once, only to prove the idiots managing our AD environment had so many conflicting records we were unable to use SCCM. Still, a solid approach. – songei2f Jun 7 '11 at 18:26
We use this method to manage our Windows/AD DNS. We have scavenging in place to deal with the dynamic records and this process for the static entries. – uSlackr Jun 7 '11 at 18:30
Totally understood. The jackasses I refer to were using static entries and other "unforeseen contingencies" as a reason to dismiss our concerns. We showed them how little they were doing with their own process, if anything at all. – songei2f Jun 7 '11 at 18:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.