Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the forward lookup DNS Zone created on a DNS installed on a domain controller ? When I DCPromo`ed the server a zone with the same name of my primary zone but with a _ at the beginning was created on the dns server. Why ? What does it do ? What is it good for ?

share|improve this question

Active Directory uses DNS to do a lot of its magic:

Active Directory uses DNS as its domain controller location mechanism and leverages the namespace design of DNS in the design of Active Directory domain names.

I'm not familiar with the specific record you're describing, but AD creates a metric ton of them on a new domain and I don't know them all.

share|improve this answer

The _msdcs zone that is created hosts AD specific DNS records. All the records that a DC would register are visible in the netlogon.dns file of each DC. See

Starting with Windows Server 2003 what would have been a subdomain is now hosted as its own zone. Each record has a specific purpose it serves. For example the is used for locating a DC by a client's netlogon service. Its also called a DCLocator record. There are similar records for locating a KDC for kerberos, a GC and also site specific records to request a service from a specific site.

These _msdcs zones and records are critical for AD to function. Please ensure all domain members including DCs always point to one or more DNS servers that host these zones.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.