How to block websites with Windows Server DNS: policies, zones and forwarders
On an Active Directory network every domain-joined computer already asks your domain controllers for names. That makes Windows Server DNS a natural place to block websites. This guide is for Windows admins: three methods, the PowerShell for each, and the pitfalls that catch people out.
Three ways to block at the domain controller
They differ in how much you can block, how they replicate, and how much work each new site costs.
Query resolution policies
Rules on the DNS server that ignore or refuse queries for listed names. Precise, but stored per server.
Local blocking zones
A zone named after the blocked domain that answers with an empty address. Replicates with Active Directory, but one zone per domain.
Forwarders to a DNS filter
Send every outside lookup to a category filter. Covers whole categories without lists on the server.
Forward outside lookups to a category filter and keep your zones local
Point your DNS servers' forwarders at our managed DNS filter and switch off root hints. Internal Active Directory names are still answered by your domain controllers, and every outside name is checked against 22 category switches and your own lists.
- No policy or zone to add per blocked site.
- One change per DNS server, nothing on the clients.
- The same rules for guests and devices that use the filter directly.
Method 1: query resolution policies
DNS policies arrived in Windows Server 2016. A policy matches queries by criteria such as the name asked for and decides what the server does with them.
# block several domains in one policy
Add-DnsServerQueryResolutionPolicy -Name "Block-Games" `
-Action IGNORE `
-FQDN "EQ,example-games.com,*.example-games.com,example-play.net,*.example-play.net"
# fail fast instead of a timeout
Add-DnsServerQueryResolutionPolicy -Name "Refuse-Example" `
-Action DENY -FQDN "EQ,example.org,*.example.org"
# run the same commands on every DNS server, for example
Invoke-Command -ComputerName dc01,dc02 -ScriptBlock { ... }
Method 2: local blocking zones
The older method works on every Windows Server version. You create a zone named after the domain you want to block, and your server answers for it instead of the real one.
# an Active Directory integrated zone that replicates Add-DnsServerPrimaryZone -Name "example.com" -ReplicationScope Forest # answer the bare name and every sub-domain with an empty address Add-DnsServerResourceRecordA -ZoneName "example.com" -Name "@" -IPv4Address 0.0.0.0 Add-DnsServerResourceRecordA -ZoneName "example.com" -Name "*" -IPv4Address 0.0.0.0
Five domains and whether a category rule would catch them
Real rows from our data. A category switch at the forwarder catches the first four and their look-alikes; the last one shows where your own block list still matters.
| Domain | Categories in our data | Caught by a switch? |
|---|---|---|
| steampowered.com | Gaming | Yes, Gaming |
| xbox.com | Gaming | Yes, Gaming |
| playstation.com | Gaming, Streaming Media | Yes, Gaming or Streaming Media |
| lichess.org | Gaming, Community Sites | Yes, Gaming, if chess should be blocked at all |
| ngrok.com | Computers & Technology | No; add it to the always-block list if tunnels are banned |
Method 3: forwarders to a category DNS filter
Your domain controllers answer internal zones themselves and pass every other name to their forwarders. Make the forwarders a category filter and every outside lookup is filtered.
# send outside lookups to the filter's two addresses Set-DnsServerForwarder -IPAddress FILTER_MAIN,FILTER_BACKUP -UseRootHint $false # check Get-DnsServerForwarder # conditional forwarders for partner domains stay as they are # internal zones are never forwarded
Because the filter sees lookups arriving from the domain controllers, rules apply to the whole network behind them. For different rules per office, give each site's DNS servers their own network in the filter's dashboard.
The three methods side by side
Many networks use two: forwarders for categories, and a policy or zone for a handful of named domains.
| Question | Query resolution policies | Local blocking zones | Forwarders to a filter |
|---|---|---|---|
| Windows Server version | 2016 and later | Any | Any |
| Replicates between servers | No, script it | Yes, if AD integrated | Set once per server |
| Blocks by category | No | No | Yes |
| Work per new site | Edit a policy on every server | Create a zone | None, or one list entry |
| Block page | Not with IGNORE or DENY | Possible via an internal web server | The filter's block page |
| Devices not on the domain | Only if they use these servers | Same | Guests can use the filter directly |
Rolling out forwarders without surprises
Changing forwarders affects everyone at once. Four steps keep the change calm.
Allow your business apps
Put sign-in, office and line-of-business domains on the filter's always-allow list first.
Start with one server
Change the forwarders on one domain controller that a test group uses.
Read the activity
After a day, look for blocks nobody expected and adjust the categories.
Move the rest
Apply the same forwarders to every DNS server and note the change in your records.
The guide to an allow list for business apps lists the core domains of the common office suites.
How the managed filter handles what your DNS servers forward
Forwarded lookups reach the main filter, or the backup when the main does not answer, and receive your categories, always-allow and always-block lists. Changes you make in the dashboard apply in seconds, with no policy to push to every domain controller.
Testing and troubleshooting
Run these on a domain-joined computer and on the DNS server after every change.
| Command | What it shows |
|---|---|
Resolve-DnsName example.com -Server dc01 | What a specific DNS server answers for a blocked name |
Clear-DnsServerCache | Empties the server's cache after a change, on the server |
Clear-DnsClientCache | Empties the client's cache; ipconfig /flushdns does the same |
Get-DnsServerQueryResolutionPolicy | Lists the policies on this server, to compare servers |
Get-DnsServerForwarder | Confirms the filter addresses and that root hints are off |
Six mistakes with DNS blocking on Windows Server
Each one leads to a filter that works on some machines and not on others.
Policies on one server only
Clients that use the second domain controller are not blocked. Script every server.
Root hints left on
Slow forwarders make the server resolve names itself, skipping the filter.
A public DNS server as a second forwarder
Some lookups go there and are never filtered. Use both filter addresses only.
Forgetting the bare domain
"*.example.com" alone leaves example.com itself open.
Clients with their own DNS
Laptops set by hand to a public resolver skip the domain controllers entirely. Block outside DNS at the firewall.
Browsers with secure DNS
Encrypted DNS in the browser bypasses the server. Turn it off by Group Policy; see blocking in Chrome and Edge.
Blocking with DNS policies by hand, or forwarding to the managed DNS filter
The same Active Directory network, two ways.
| Task | Policies and zones by hand | Forwarders to the managed DNS filter |
|---|---|---|
| Block a category of sites | Not possible; list every domain | One of 22 category switches |
| Add a site | Edit a policy on every DNS server | One always-block entry, applied in seconds |
| New sites in a category | Missed until someone adds them | Covered as they are categorized |
| Show what was blocked | Enable and read DNS logs on each server | Activity and reports in one dashboard |
| Guest Wi-Fi outside the domain | A separate setup | The same filter, its own profile |
Windows Server DNS blocking: frequently asked questions
How do I block a website with Windows Server DNS?
On Windows Server 2016 or later, add a query resolution policy with Add-DnsServerQueryResolutionPolicy, using the FQDN criterion for the domain and its sub-domains and the action IGNORE or DENY. Repeat it on every DNS server.
Do DNS policies replicate between domain controllers?
No. Query resolution policies are stored per server, so the same command has to run on every DNS server your clients use, unlike Active Directory integrated zones, which replicate.
Can Windows Server DNS block websites by category?
Not by itself. Point its forwarders at a category DNS filter and turn off root hints, so every outside lookup is checked against categories while internal Active Directory names stay on your servers.
What is the difference between IGNORE and DENY?
With IGNORE the server does not answer, so the client waits and then gives up. With DENY the server sends an error straight away, which fails faster.
Will forwarding to a filter break Active Directory?
No. Domain controllers answer your internal zones themselves and only forward names they are not authoritative for. Keep clients pointed at the domain controllers as before.
Can I block websites for one office only?
Yes. Query resolution policies can match the client subnet as well as the name, so a rule can apply to one office network. With forwarders to the filter, give that office's DNS servers their own network and profile in the dashboard.
Do I still need Group Policy for browsers?
Yes, for one setting. Browsers with secure DNS switched on send lookups past your DNS servers, so turn it off by Group Policy on managed computers to keep every lookup going through your domain controllers.
How do I test a DNS block on Windows Server?
Run Resolve-DnsName example.com -Server followed by the server name. Clear the server cache with Clear-DnsServerCache and the client cache with Clear-DnsClientCache after a change.
The managed DNS filter costs $99 a month for one site, and organisations with several sites get one quote. A pilot with one domain controller's forwarders lets your test group try the categories before the whole network does.
Keep Active Directory, add category filtering
Tell us how many sites and domain controllers you run. We will set up a pilot and give you the two forwarder addresses to try.
Windows Server, Active Directory and PowerShell are trademarks of Microsoft Corporation. They are named here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by Microsoft.