Domains and DNS

Pilot Microsoft Entra AD group enforcement safely: prepare every writable domain controller, audit blocked writes, test Cloud Sync, and plan rollback.

Deploy Microsoft Entra domainless SAML federation safely for B2B guests: validate issuer routing, redemption order, claims, certificates, logs, and rollback.

Twenty-five practical Active Directory interview questions with clear, technically accurate answers covering AD DS, DNS, Kerberos, replication, Group Policy, recovery, and security.

Choose the correct deployment scenario, protect the DSRM password, review functional levels, and collect evidence after domain controller promotion.

A preparation and handover checklist for a physical domain controller: hardware support, recovery, network identity, deployment decisions, and acceptance evidence.

A subnet-to-site change can affect domain controller discovery, site-linked Group Policy, and site-aware services. Verify each separately instead of assuming a fixed convergence time.

Understand DNS records, resolvers, caching, and the checks that help distinguish a name-resolution failure from an application or Active Directory problem.

Separate Microsoft 365 domain conversion from application migration. Plan staged rollout, verify PHS or PTA, and define rollback before retiring AD FS.

Three different mechanisms in Windows DNS that all route queries to another DNS server, all sound similar, and all solve different problems. Standard forwarders are the catch-all for everything the server doesn't own. Conditional forwarders route specific domains to specific upstreams. Stub zones cache the authoritative nameserver list for an external zone. Picking the wrong one produces silent resolution failures. Here's the decision tree for someone seeing these terms for the first time.

Every Windows DNS server ships with a list of thirteen root nameservers baked in. The list is the bootstrap that lets the server resolve any name on the public internet without depending on an upstream resolver. Most admins never touch it. In two specific situations — split-brain environments and resolvers that shouldn't reach public DNS at all — leaving the default in place is actively wrong. Here's what root hints actually do, when they help, and when to empty the file.

Most Windows DNS servers run on defaults that worked fine in 2008 and haven't really been revisited. A handful of those defaults — open recursion, no cache-pollution protection, no scavenging, listening on every interface — don't hold up in a modern enterprise threat environment. Here's what every server-level DNS setting actually does, and a baseline configuration sequence that takes a fresh DNS server from 'installed' to 'production-ready' in about ten minutes.

A reverse lookup zone is the database on a DNS server that answers the opposite question from a forward zone — instead of 'what's the IP for this name,' it answers 'what name belongs to this IP.' Most clients don't query reverse DNS often, but the ones that do (mail systems, RDP, audit tools, monitoring) fall over noisily when reverse zones are missing or wrong. Here's the full picture, from what a reverse zone is to how to set one up across odd subnet boundaries.

A forward lookup zone is the database on a DNS server that answers 'what's the IP address for this hostname.' In a Windows Server environment running Active Directory, the choices you make when creating that zone — primary vs secondary vs AD-integrated, who replicates it, who can update records in it — determine whether your forest is robust or fragile for years afterward. Here's the full picture, written for someone who knows DNS exists but hasn't actually configured a Windows DNS server before.

OOF is turned on but external senders aren't getting replies. Walk the external-replies toggle, the once-per-sender rule, the spam-filter override, transport rules that suppress OOFs, and the remote domain configuration that controls everything.

The wizard makes adding a domain to Microsoft 365 look like a checklist. Then six months later marketing wonders why their broadcasts are landing in spam. Here's the order to configure SPF, DKIM, and DMARC for an EXO tenant, the seven mistakes I see most often, and the staged DMARC enforcement that doesn't break payroll.