Overview
The Root Hints Functionality monitoring test appears under the DNS Server indicator for a domain controller.
The DNS Server indicator is only shown for domain controllers where the DNS Server role is installed.
Monitoring Benefit
The Root Hints Functionality test validates that the root hints configured on the domain controller are reachable and answering. Root hints are the fallback path for resolving names the server is not authoritative for and cannot forward — so this test and Forwarders Functionality together cover external name resolution.
Root hints tend to be the quietest part of a DNS configuration. They are set once at install and rarely revisited, which means a broken root hints list can sit unnoticed until the day forwarders fail and the fallback turns out not to work either.
There is one test for each listening IP address detected on the server.
How do we verify the monitoring test results?
1. Run the same test on the domain controller, substituting the listening address the failing test reports:
Test-DnsServer -IPAddress <listening IP> -Context RootHints2. Check the root hints the server holds. An edited, truncated or outdated list is the usual cause:
Get-DnsServerRootHintCompare against the expected root servers. Where the list has been modified or emptied, it can be restored from the server's own cache file.
3. Confirm outbound DNS is permitted. Like forwarding, root hint resolution is outbound UDP and TCP 53 from the domain controller. Many environments deliberately block this and rely entirely on forwarders — in that case a root hints failure is expected, and the test can be disabled for those servers rather than investigated.
4. Consider whether root hints are meant to work here. In an environment that forwards all external resolution through a controlled path, root hints may be intentionally unusable. Establish which design applies before treating the result as a fault.
Common warning or error results, and potential solutions
| Result | Potential solution |
| Root hints unreachable | Confirm whether outbound DNS to the root servers is permitted from this domain controller. In many environments it is deliberately blocked and forwarders carry all external resolution. |
| Root hints list is empty or incomplete | Check Get-DnsServerRootHint. The list can be restored from the server's cache file where it has been modified or cleared. |
| Root hints and forwarders both failing | External name resolution has no working path from this server. This is the more serious combination and should be treated ahead of either result on its own. |
| Test fails on one listening address only | Check the binding and any source-address-based egress rules for that interface. |
| Expected failure in a forwarder-only design | Where root hints are intentionally not used, disable this test for those servers from the Active Directory section of Alert Intelligence rather than leaving a permanent alert. |
Enable or disable this test from the Active Directory section of Alert Intelligence. Alerts are delivered under the DNS Server workload for domain controllers.
Related monitoring tests
- Forwarders Functionality — the primary external resolution path.
- DNS Server Functionality — tests that the DNS server itself responds.
- DNS Server Settings — the collected DNS server configuration.
Comments
0 comments
Please sign in to leave a comment.