DNS Conditional Forwarder: Route Queries to the Right Server
A query follows a conditional route only when its name matches the configured DNS namespace and no applicable local data takes precedence. Other names follow the server’s normal resolution path. A conditional forwarder in DNS therefore directs a selected namespace to designated servers; it is not a general replacement for all upstream resolvers.
A concrete query path
Consider a Windows Server DNS resolver for an enterprise network. A partner operates the private namespace partner.example on two reachable DNS servers, 10.20.0.10 and 10.20.0.11. The local resolver has no authoritative copy of that zone and is configured to forward matching queries to those addresses. This conditional DNS forwarder example uses private addresses, not public endpoints.
When a client asks for device1.partner.example, the resolver first checks applicable local authoritative data and cache. If no terminal answer is available, the name matches partner.example, so the dns conditional forwarder sends the query to a configured target. The target’s answer is returned to the client. A valid negative answer, such as NXDOMAIN for a nonexistent name, is normally returned as an answer; it is not the same as a timeout.
For www.example.com, the suffix does not match. Assuming no local answer or applicable delegation, the server uses its normal server-level forwarders or another configured resolution path. It does not send the query to the partner targets merely because they are listed in the conditional rule. Microsoft describes the Windows DNS resolution order and fallback controls.
Configure the rule on Windows Server
Before creating a DNS conditional forwarder, confirm the exact namespace, target addresses, routing and permission to query the partner servers. Both UDP and TCP port 53 must be reachable as required by the environment. The targets must be able to answer for the intended namespace and must not forward the same queries back in a loop.
On the intended DNS server, an administrator can use elevated PowerShell to create a locally stored conditional forwarding zone:
Add-DnsServerConditionalForwarderZone -Name "partner.example" `
-MasterServers @("10.20.0.10", "10.20.0.11") -PassThru
The sample omits -UseRecursion, preventing alternative recursion fallback for this conditional zone when its targets fail. If an Active Directory-integrated rule is needed across DNS servers, choose a replication scope deliberately instead of assuming a locally stored rule is shared. Microsoft documents the command and replication options.
Review the resulting settings, including the target list and fallback policy:
Get-DnsServerZone -Name "partner.example" |
Format-List ZoneName, ZoneType, MasterServers, ForwarderTimeout, UseRecursion
Failure is different from an unmatched name
An unmatched name follows the ordinary path because the rule does not apply. A matching query whose targets do not answer is a different situation. With fallback disabled for the conditional DNS forwarder, the local server cannot use another recursive path for that rule and the query fails if the targets cannot supply a terminal result. With fallback enabled, another path may be attempted only if server-wide recursion, configuration and remaining time permit it. A timeout can expire before all possible paths are tried.
For a private namespace, broad fallback can leak query names or return an inconsistent public answer. The policy should reflect whether another resolver is actually authorized and able to answer. A negative response from an upstream server normally ends the lookup rather than triggering a search elsewhere.
Verify the route, not just the answer
Test a known partner record directly against each target, then through the local resolver. Test an unrelated name through the local resolver as well:
Resolve-DnsName device1.partner.example -Server 10.20.0.10 -DnsOnly
Resolve-DnsName device1.partner.example -Server 10.20.0.11 -DnsOnly
Resolve-DnsName device1.partner.example -Server 192.0.2.53 -DnsOnly
Resolve-DnsName www.example.com -Server 192.0.2.53 -DnsOnly
Here 192.0.2.53 represents the local DNS server; substitute its actual address. Repeat a representative target test with -TcpOnly. Cached data can hide the path, so use a suitable uncached test name and inspect DNS logs or packet captures to confirm forwarding. Test from a representative client too.
For each conditional DNS forwarding rule, record the namespace, targets, replication scope, timeouts and fallback policy. Verify both matched and unmatched names, then monitor the targets and the path that reaches them.