Overview
The Forwarders Functionality monitoring test appears under the DNS Server indicator for a domain controller.
The DNS Server indicator is only shown for domain controllers where the DNS Server role is installed.
Monitoring Benefit
The Forwarders Functionality test validates that the DNS forwarders configured on the domain controller are reachable and answering. Forwarders are how the domain controller resolves anything outside its own authoritative zones, so when they fail, internal name resolution keeps working and everything external stops — which is why this failure is so often misread as an internet or firewall problem rather than a DNS one.
There is one test for each listening IP address detected on the server. A domain controller listening on several addresses produces several results.
How do we verify the monitoring test results?
1. Run the same test on the domain controller, substituting the listening address the failing test reports:
Test-DnsServer -IPAddress <listening IP> -Context Forwarders2. Check which forwarders are configured. The test validates the forwarders the server actually holds, so start by confirming they are the ones you expect:
Get-DnsServerForwarderForwarders pointing at decommissioned resolvers are a common cause — the configuration is valid, the target no longer exists.
3. Query a forwarder directly. Confirm the forwarder itself answers from this server:
Resolve-DnsName -Name www.microsoft.com -Server <forwarder IP>If the forwarder answers here but the test fails, the problem is between the DNS service and the forwarder rather than with the forwarder itself.
4. Check the outbound path. Forwarding is outbound UDP and TCP 53 from the domain controller. A firewall change, a new egress rule or an ISP-side change to a public resolver will present as a forwarder failure with nothing having changed on the server.
Common warning or error results, and potential solutions
| Result | Potential solution |
| All forwarders failing | Confirm outbound DNS is still permitted from the domain controller, and that the configured forwarder addresses are still live. Check whether a firewall or egress policy changed. |
| Internal names resolve, external names do not | This is the signature of a forwarder problem. The server is answering correctly for its own zones and failing for everything else. |
| Test fails on one listening address only | Check the binding and any source-address-based firewall rules for that interface. |
| Intermittent forwarder failures | Check whether the forwarder is a public resolver subject to rate limiting, and whether more than one forwarder is configured so the server can fall back. |
| Forwarders configured but none reachable | The server will fall back to root hints if it is permitted to. Check the Root Hints Functionality test as well — if both are failing, external resolution has no path at all. |
Enable or disable this test from the Active Directory section of Alert Intelligence. Alerts are delivered under the DNS Server workload for domain controllers.
Related monitoring tests
- DNS Server Functionality — tests that the DNS server itself responds.
- Root Hints Functionality — the other external resolution path.
- DNS Server Settings — the collected DNS server configuration.
Comments
0 comments
Please sign in to leave a comment.