DNS error 0x000025B3: primary zone needs a data file

Missing zone data file after reboot or manual delete

This is the most common cause. Had a client last month whose whole DNS zone vanished after a Windows Update reboot. The zone file lives in %SystemRoot%\System32\dns and if it gets deleted, renamed, or corrupted, the DNS service throws error 0x000025B3 when it tries to load the zone.

The fix: Check the zone file exists. Open File Explorer and go to C:\Windows\System32\dns. Look for a file named [zone-name].dns. If it's missing, you need to re-create it.

If you have a backup copy from a recent backup, just copy it back. No backup? You can rebuild the zone file from the registry or AD if it's an AD-integrated zone. But for a standard primary zone, you'll likely need to recreate the zone from scratch.

How to rebuild a standard primary zone file

1. Open DNS Manager (dnsmgmt.msc).
2. Delete the broken zone (right-click, Delete). Confirm.
3. Right-click Forward Lookup Zones, select New Zone.
4. Choose Primary zone, then zone name must match the old one.
5. Select "Create a new file with this file name" – it will create a blank .dns file.
6. Finish the wizard. Now add back your records manually or import from a text backup.

If the zone is AD-integrated, you can use dnscmd /ZoneResetType [zone-name] to force reload the file from Active Directory. But most people running standard primary zones just recreate it.

Corrupted zone data file content

Sometimes the file exists but has corrupted entries. I've seen this after a power failure during a zone write. The DNS server reads the file and finds garbage, so it won't load the zone.

The fix: Open the .dns file in Notepad. It's a plain text file. Look for lines with weird characters, broken SOA records, or missing CRLF at the end. The file should start with a SOA record like:

@  IN  SOA  dnsserver.domain.com.  admin.domain.com. (
   2023100101 ; serial number
   3600       ; refresh (1 hour)
   600        ; retry (10 minutes)
   86400      ; expire (1 day)
   3600       ; minimum TTL (1 hour)
   )

If the SOA is missing or formatted wrong, the zone won't load. You can manually fix the SOA, or delete the zone and recreate it. Quick tip: Before doing anything, stop the DNS service (net stop dns), make a backup copy of the file, then start again.

If you don't want to manually edit, use this PowerShell to dump the zone content and check for errors:

Get-Content -Path "C:\Windows\System32\dns\yourzone.dns" | Select-Object -First 10

If you see empty lines or non-alphanumeric symbols, the file is toast. Go with the recreate approach.

Permissions or file lock issue

Less common but still a pain. The DNS service runs as NETWORK SERVICE on most Windows Servers. If that account can't read or write the .dns file, you get the same error. I ran into this after moving zone files to a different drive manually.

The fix: Check NTFS permissions on the dns folder and the specific .dns file.

1. Right-click the .dns file, go to Properties, Security tab.
2. Make sure NETWORK SERVICE has Read and Write permissions.
3. Also check the dns folder itself – same permissions needed.
4. If they're missing, add them: click Edit, Add, type NETWORK SERVICE, grant Full Control.

Another subtle one: file is in use by another process. Use handle.exe or lslocks (Linux) to see if something else has a handle on the file. On Windows, you can use netstat -ano to check if DNS port 53 is already bound by another app – that can also block zone loading. Kill whatever is using it.

Lastly, make sure the DNS service is actually running. Run services.msc, check DNS Server status. If it's stopped, start it. If it fails to start, check the System event log for related errors.

Quick reference table

If none of these work, you might be dealing with a deeper issue like a corrupted DNS registry key. But 95% of the time it's one of these three. Stop overthinking and start with the file check.