Administering DNS Server zones and records from PowerShell, then verifying with Resolve-DnsName

Goal

Inspect DNS Server zones, add or read records, and enable stale-record cleanup, verifying every change from a client resolver rather than trusting the server-side write alone.

Prerequisites

The DnsServer PowerShell module, available on a server running the DNS Server role or via RSAT against a remote one; rights to the target zone.

Steps

1. List the zones a server hosts: Get-DnsServerZone -ComputerName DNS1 | Select-Object ZoneName, ZoneType, IsDsIntegrated.
2. Add an A record: Add-DnsServerResourceRecordA -ZoneName "contoso.com" -Name "app1" -IPv4Address "10.0.0.15" -ComputerName DNS1.
3. Add a CNAME pointing at it: Add-DnsServerResourceRecordCName -ZoneName "contoso.com" -Name "app" -HostNameAlias "app1.contoso.com" -ComputerName DNS1.
4. Read back what is actually stored, not what was intended: Get-DnsServerResourceRecord -ZoneName "contoso.com" -Name "app1" -ComputerName DNS1.
5. Enable scavenging of stale dynamic records at the server level, then per zone: Set-DnsServerScavenging -ScavengingState $true -ScavengingInterval 7.00:00:00 -ComputerName DNS1, then Set-DnsServerZoneAging -ZoneName "contoso.com" -Aging $true -RefreshInterval 7.00:00:00 -NoRefreshInterval 7.00:00:00 -ComputerName DNS1. Both intervals are TimeSpan values (a bare 168 would be read as 168 ticks, not hours) and combine to control how long an unrefreshed record survives before scavenging removes it.
6. If the server's own cached answers seem stale during testing, clear them: Clear-DnsServerCache -ComputerName DNS1 -Force.
7. Verify from a client, since the server can be correct while a caching resolver elsewhere is not: Resolve-DnsName app1.contoso.com -Server DNS1 -Type A and again without -Server to check what the client's configured resolver actually returns.

Expected result

Resolve-DnsName against the authoritative server returns the new record immediately; against the client's normal resolver it may lag behind by the record's TTL.

Limits and test basis

All cmdlets here are documented in the DnsServer and DnsClient PowerShell module references. Scavenging only removes dynamically registered records that go unrefreshed for both the no-refresh and refresh intervals combined — it does not touch static records, but records that were registered dynamically and are no longer refreshed by their owner (for example a device that registered once) can be removed while still in use if the intervals are set too short. To undo a record, use Remove-DnsServerResourceRecord -ZoneName "contoso.com" -RRType A -Name "app1" -ComputerName DNS1 (or -RRType CName -Name "app"); there are no per-type remove cmdlets. In an AD-integrated zone, other DNS servers see a change only after directory replication. No reboot is needed for any of these changes, though resolvers holding a cached answer will not see a change until their TTL expires.