DNS _msdcs zone modernization

List all DNS zones and look for _msdcs:

Get-DnsServerZone | Where-Object { $_.ZoneName -like "*_msdcs*" }

Modern design (no action needed) — you will see _msdcs.<forest-name> listed as a Primary zone:

ZoneName                          ZoneType   IsAutoCreated  IsDsIntegrated  IsReverseLookupZone  IsSigned
--------                          --------   -------------  --------------  -------------------  --------
_msdcs.premier.local              Primary    False          True            False                False

Legacy design (conversion required) — _msdcs.<forest-name> will NOT appear in the zone list. Instead, _msdcs exists only as a delegated subdomain under your forest zone. You can confirm this by checking for the delegation NS records:

Get-DnsServerResourceRecord -ZoneName "<forest-name>" -Name "_msdcs" -RRType NS

If this returns NS records, your environment uses the legacy delegated subdomain design.

Additional validation — confirm the zone type:

# This will succeed on modern design
Get-DnsServerZone -Name "_msdcs.<forest-name>"

# If you get an error like "Zone _msdcs.<forest-name> was not found", you have the legacy design

Create the standalone _msdcs zone

On an existing self-managed Domain Controller:

dnscmd localhost /ZoneAdd "_msdcs.<forest-name>" /DsPrimary /dp /forest

This creates _msdcs.<forest-name> as a dedicated AD-integrated zone with Forest-wide replication scope. All DCs in the forest will receive a copy via the ForestDnsZones partition.

Wait for AD replication to propagate:

repadmin /syncall /AeD

Verify the zone exists (run on multiple DCs):

Get-DnsServerZone -Name "_msdcs.<forest-name>"

Remove the old delegation from the parent zone

The old _msdcs subdomain node and its records still exist in the parent zone. These must be removed so that DNS queries are served exclusively from the new standalone zone.

# Remove the _msdcs subtree (NS delegation + all child records) from the parent zone
dnscmd localhost /NodeDelete <forest-name> _msdcs /tree /f

Force all DCs to re-register SRV records

With the old subdomain removed and the new standalone zone in place, all DCs must re-register their locator records into the new zone.

Run the following on every on-premises Domain Controller:

# Flush DNS cache
ipconfig /flushdns

# Restart Netlogon — this triggers re-registration of all SRV, CNAME, and A records
net stop netlogon
net start netlogon

# Force host record registration
ipconfig /registerdns

Verify

Wait 5–10 minutes for replication, then verify:

Confirm records populated in the new standalone zone:

Get-DnsServerResourceRecord -ZoneName "_msdcs.<forest-name>" -RRType SRV

You should see _ldap._tcp.dc, _kerberos._tcp.dc, _ldap._tcp.gc, and site-specific records for all on-premises DCs.

Confirm DNS resolution works end-to-end:

Resolve-DnsName "_ldap._tcp.dc._msdcs.<forest-name>" -Type SRV
Resolve-DnsName "_kerberos._tcp.dc._msdcs.<forest-name>" -Type SRV

All on-premises DCs should appear in the results.

Confirm the old delegation is gone from the parent zone:

Get-DnsServerResourceRecord -ZoneName "<forest-name>" -Name "_msdcs" -RRType NS -ErrorAction SilentlyContinue

This should return nothing.

For more information about modernizing DNS _msdcs zones, see How To Split and Migrate Child Domain DNS Records To a Dedicated DNS Zone on the Microsoft Core Infrastructure and Security Blog website.