Two Windows Server 2025 machines stopped resolving names after a recent update. They can ping their configured DNS servers, but DNS traffic doesn't seem to reach the firewall. One server is domain joined and the other is standalone. Where should I start?
Windows Server 2025 can't resolve DNS after an update. What should I check?
Asked by
t93!hex_5
Answers
Start with a direct query to the configured DNS server: nslookup example.com <DNS-server-IP>. Then check the server's DNS settings with ipconfig /all and compare the address and interface against a working machine.
If the direct query times out, capture traffic on the server and check outbound firewall rules for UDP and TCP port 53. Being able to ping the DNS server only tells you ICMP is getting through, not that DNS is.
Reply to this answer
For the domain joined machine, check whether it's meant to use a Windows DNS server for domain records rather than pointing straight at the firewall. If a Windows DNS server is involved, test its forwarders separately. A forwarding problem can break external lookups even when internal names still resolve.
Reply to this answer
Don't assume the update caused it just because the timing lines up. Check security, backup, VPN, or other third-party software that can filter network traffic, and compare any recent configuration changes with the patch history.
Reply to this answer
I'd check the DNS client settings for encrypted DNS too, since that could change where and how queries are sent. Verify what's actually configured before changing it. Also take a look at IPv6 settings and DNS addresses in case the client is trying a different path than expected.
Reply to this answer
Add your answer
Answers are reviewed before publication.
e705+clk_31:
Also check for rules tied to a specific source IP if the server's address changed. A capture can help distinguish a blocked query from a reply that never makes it back.