Noticed some errors after running dcdiag about delegation and found the _msdcs delegate zone contains two NS entries pointing to invalid servers. One no longer exists, the other is no longer a DC.

To be clear, I'm talking about:

Forward Lookup Zones

  • contoso.com
    • _msdcs (grey)

NOT _msdcs.contoso.com zone at the root level of Forward Lookup Zones.

Can this be deleted? Should the NS entries be changed to something else? What is the best practice to resolve here?

This has come about as we're at FFL/DFL 2003, wanting to raise to 2008, and I want to make sure any AD strangeness is cleaned up before doing so.

1 Answer 1


Go to the Name Servers tab of the zone properties and remove any incorrect name servers. Then verify that the corresponding NS records have been removed from the zone.

Check any and all DNS zones (including reverse lookup zones) and perform the same if needed.

  • I cleared these out, but the invalid nameservers still show in the _mcdcs delegate zone.
    – Irongrave
    Aug 27, 2019 at 21:07
  • If you've removed them from the name servers tab, and the NS records for them still exist, then you can just delete the NS records.
    – joeqwerty
    Aug 27, 2019 at 21:41
  • So just so I'm clear -- the _msdcs delegate zone will be completely empty when I delete them, and that will not present a problem? Should this zone be populated with active servers?
    – Irongrave
    Aug 27, 2019 at 22:35
  • Hmmm... I must have misread your question. Add the existing DNS servers to the Name Servers tab of the zone properties. Then remove any NS records for non existing DNS servers.
    – joeqwerty
    Aug 27, 2019 at 23:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .