Quick answer: Open DNS Manager, right-click the zone, go to Properties > Zone Transfers > Master Servers, add the primary DNS server IP(s), click OK, and reload the zone.
I've seen this error pop up most often when someone sets up a secondary DNS zone but forgets to tell Windows Server which primary DNS server holds the zone data. The error is blunt but honest: the zone doesn't know where to pull its records from. This usually happens on Windows Server 2008 R2 through 2022, but I've also seen it on older 2003 boxes in legacy environments. The trigger is almost always a misconfigured zone transfer setting—either the master IP list is empty or it got cleared during a migration or scripted deployment.
Step-by-Step Fix
- Open DNS Manager. Press Win + R, type
dnsmgmt.msc, and hit Enter. You should see your DNS server listed under the console root. - Locate the problem zone. Expand your server name, then expand Forward Lookup Zones (or Reverse if that's where the error is). Find the zone with the red X or exclamation mark. Right-click it and choose Properties.
- Go to the Zone Transfers tab. This is where the master IP list lives. Don't confuse it with the Name Servers tab—that's for delegation, not zone transfer sources.
- Check Allow zone transfers. It should be set to Only to servers listed on the Name Servers tab or Only to the following servers. If it's set to To any server, that's a security risk, but it won't fix this error by itself—you still need master IPs.
- Click the Master Servers button. You'll see a window titled Master Servers. If it's empty, that's your problem. Click Add.
- Enter the primary DNS server IP address. Type the IP of the DNS server that hosts the primary copy of the zone. For example,
192.168.1.10. If you have multiple primaries (for redundancy), add each one. Click OK after each entry. - Apply changes. Click Apply, then OK to close the Properties window. After you apply, the error icon should disappear within a few seconds. If it doesn't, right-click the zone and select Reload from Master to force a refresh.
- Verify replication. Right-click the zone again and choose Refresh. The zone should now load its records. You can check by expanding the zone; you should see A, CNAME, MX, and other records appear.
Alternative Fixes If the Main One Fails
Sometimes the above doesn't cut it. Here are three other things to try.
1. Check Firewall Rules
The primary DNS server must allow inbound TCP and UDP on port 53 from the secondary server. If you have Windows Firewall enabled, check that the DNS Service inbound rule is active. On the secondary, test connectivity with telnet <primary-ip> 53 (though telnet might not be installed by default). If the connection times out, you've found the blocker.
2. Clear Stale Zone Data
If the zone has corrupt cached data, delete it and recreate it. Right-click the zone in DNS Manager, select Delete, confirm. Then right-click Forward Lookup Zones (or Reverse), choose New Zone, and run through the wizard. Pick Secondary zone, enter the domain name, and when asked for master IPs, type them in. This is the nuclear option, but it works when the zone metadata is hosed.
3. Use PowerShell Instead of the GUI
Sometimes the GUI cache holds stale info. Open PowerShell as Administrator and run this command, replacing example.com and 192.168.1.10 with your zone and master IP:
Add-DnsServerSecondaryZone -Name "example.com" -ZoneFile "example.com.dns" -MasterServers 192.168.1.10If the zone already exists, you can use:
Set-DnsServerSecondaryZone -Name "example.com" -MasterServers 192.168.1.10After running this, check DNS Manager and refresh. The error should clear.
Prevention Tips
This error is easy to avoid. When you create a secondary zone, always fill in the master server IPs during the wizard—don't skip that step. If you're scripting zone creation with PowerShell, double-check your script includes the -MasterServers parameter. Also, make sure time on both DNS servers is synced to the same NTP source. A time skew of more than 5 minutes can cause zone transfer failures that look like this error.
Finally, if you're managing multiple sites, standardize your master IP list. Use a naming convention in your DNS naming policy so you always remember which server is the primary. It sounds basic, but I've seen admins chase this error for hours only to find they'd typed the wrong IP.