Add-DnsServerZoneTransferPolicy

Syntax

Add-DnsServerZoneTransferPolicy
   [-ComputerName <String>]
   [-PassThru]
   [[-Action] <String>]
   [-ClientSubnet <String>]
   [[-Condition] <String>]
   [-InternetProtocol <String>]
   [-Disable]
   [-Name] <String>
   [-ProcessingOrder <UInt32>]
   [-ServerInterfaceIP <String>]
   [-TimeOfDay <String>]
   [-TransportProtocol <String>]
   [-CimSession <CimSession[]>]
   [-ThrottleLimit <Int32>]
   [-AsJob]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Add-DnsServerZoneTransferPolicy
   [-ComputerName <String>]
   [-PassThru]
   [-ZoneName] <String>
   [[-Action] <String>]
   [-ClientSubnet <String>]
   [[-Condition] <String>]
   [-InternetProtocol <String>]
   [-Disable]
   [-Name] <String>
   [-ProcessingOrder <UInt32>]
   [-ServerInterfaceIP <String>]
   [-TimeOfDay <String>]
   [-TransportProtocol <String>]
   [-CimSession <CimSession[]>]
   [-ThrottleLimit <Int32>]
   [-AsJob]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Add-DnsServerZoneTransferPolicy
   [-ComputerName <String>]
   [-PassThru]
   [-InputObject] <CimInstance>
   [[-ZoneName] <String>]
   [-CimSession <CimSession[]>]
   [-ThrottleLimit <Int32>]
   [-AsJob]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Description

The Add-DnsServerZoneTransferPolicy cmdlet adds a zone transfer policy to a Domain Name System (DNS) server. A policy determines zone transfers based on criteria that you specify in the policy.

A policy consists of criteria and action.

The criteria are a logical combination of client subnet, server interface IP address, fully qualified domain name (FQDN), Internet Protocol (IPv4/IPv6), transport protocol (UDP/TCP), time of day, and query type.

Specify criteria in the following format:

operator, value01, value02, . . . , operator, value03, value04, . . .

The operator is either EQ or NE. You can specify no more than one of each operator in a criterion.

The policy treats values that follow the EQ operator as multiple assertions which are logically combined (OR'd). The policy treats values that follow the NE operator as multiple assertions which are logically differenced (AND'd).

This cmdlet combines multiple criteria by using the value of the Condition parameter as the logical operator. This parameter takes one of the following values:

• OR. The policy evaluates criteria as multiple assertions which are logically combined (OR'd).
• AND. The policy evaluates criteria as multiple assertions which are logically differenced (AND'd).

If a query meets the criteria of a policy, the action is the response that the policy requires. You can specify DENY or IGNORE.

You can create policies for zone transfer at either the server level or the zone level. Server level policies apply on every zone transfer query that occurs on the DNS server. Zone level policies apply only on the queries on a zone hosted on the DNS server. The most common use for zone level policies is to implement blocked or safe lists.

Zone level policies apply to the zone in which you create them. You cannot create a zone level policy without a zone. If you remove a zone, that removal deletes the associated zone level policies.

Examples

Example 1: Create a server level zone transfer policy

PS C:\> Add-DnsServerClientSubnet -Name "AllowedSubnet" -IPv4Subnet 172.21.33.0/24 -PassThru
PS C:\> Add-DnsServerZoneTransferPolicy -Name "NorthAmericaPolicy" -Action IGNORE -ClientSubnet "ne,AllowedSubnet" -PassThru | Format-List *
Name                                             IPV4Subnet                                       IPV6Subnet
----                                             ----------                                       ----------
AllowedSubnet                                    {172.21.33.0/24}



Action                : Ignore
AppliesOn             : ZoneTransfer
Condition             : And
Content               : 
Criteria              : {DnsServerPolicyCriteria}
IsEnabled             : True
Level                 : Server
Name                  : NorthAmericaPolicy
ProcessingOrder       : 1
ZoneName              : 
PSComputerName        : 
CimClass              : root/Microsoft/Windows/DNS:DnsServerPolicy
CimInstanceProperties : {Action, AppliesOn, Condition, Content...} 
CimSystemProperties   : Microsoft.Management.Infrastructure.CimSystemProperties

The first command creates a client subnet named AllowedSubnet by using the Add-DnsServerClientSubnet cmdlet. That subnet includes the specified IP subnet.

The second command creates a zone transfer policy that disallows all customers that do not belong to the AllowedSubnet subnet. This policy is a server level policy, and, so, it applies on all the zones on the server.

Example 2: Disallow zone transfers by server interface

PS C:\> Add-DnsServerZoneTransferPolicy -Name "InternalTransfers" -Action IGNORE -ServerInterfaceIP "ne,10.0.0.33" -PassThru
Name                                 ProcessingOrder                      IsEnabled                            Action
----                                 ---------------                      ---------                            ------
internalTransfers1                   3                                    True                                 Ignore

This command creates a zone transfer policy that disallows all zone transfer queries that do not arrive on server interface 10.0.0.33.

Example 3: Create a zone level zone transfer policy

PS C:\> Add-DnsServerZoneTransferPolicy -Name "InternalTransfers" -Action IGNORE -ServerInterfaceIP "ne,10.0.0.33" -PassThru -ZoneName "contoso.com" | Format-List *
Action                : Ignore
AppliesOn             : ZoneTransfer
Condition             : And
Content               : 
Criteria              : {DnsServerPolicyCriteria}
IsEnabled             : True
Level                 : Zone
Name                  : InternalTransfers
ProcessingOrder       : 1
ZoneName              : contoso.com
PSComputerName        : 
CimClass              : root/Microsoft/Windows/DNS:DnsServerPolicy
CimInstanceProperties : {Action, AppliesOn, Condition, Content...} 
CimSystemProperties   : Microsoft.Management.Infrastructure.CimSystemProperties

This command creates a zone level zone transfer policy for contoso.com.

Parameters

-Action

-AsJob

-CimSession

-ClientSubnet

-ComputerName

-Condition

-Confirm

-Disable

-InputObject

-InternetProtocol

-Name

-PassThru

-ProcessingOrder

-ServerInterfaceIP

-ThrottleLimit

-TimeOfDay

-TransportProtocol

-WhatIf

-ZoneName

Outputs

CimInstance

Related Links

• Get-DnsServerZoneTransferPolicy
• Remove-DnsServerZoneTransferPolicy
• Set-DnsServerZoneTransferPolicy
• Start-DnsServerZoneTransfer
• Add-DnsServerClientSubnet
• Add-DnsServerQueryResolutionPolicy