Fix DNS Error 0x258D: Zone Not Secondary in 3 Steps

What This Error Means

You're staring at error 0x0000258D in your DNS console or event log. The server is telling you "Hey, I can't treat this zone as a secondary zone because it's already set as something else." Usually this pops up when you try to change a zone's type from primary to secondary, or when you're setting up zone transfers and the server gets confused.

I've seen this most often after someone migrates a DNS zone from one server to another, or when you're setting up a new secondary server and the zone already exists as a primary on that same box.

Fix 1: The 30-Second Check - Is the Zone Actually Secondary?

Don't do anything complicated yet. First, let's see what type of zone you're dealing with.

Open your DNS Manager console (press Windows Key + R, type dnsmgmt.msc, hit Enter).
Expand the server name, then expand Forward Lookup Zones (or Reverse if that's where the error is).
Right-click the zone that's giving the error and select Properties.
Look at the Type field at the top. It'll say "Primary", "Secondary", or "Stub".

If it says Primary, that's your problem. You can't set a primary zone as secondary on the same server. You'd need to either delete the zone and re-create it as secondary, or change the type to secondary (which the error is blocking).

Fix 2: The 5-Minute Fix - Delete and Recreate the Zone

This is the most reliable fix I've used over the years. When the server gets confused about zone types, blowing away the zone and starting fresh works 90% of the time.

Back up your zone data first. Right-click the zone, select Export List to save a text file of records. Or better, run this in PowerShell as admin:
```
dnscmd /ZoneExport example.com example.com.dns
```
This saves a file to C:\Windows\System32\dns.
In DNS Manager, right-click the zone and select Delete. Confirm the deletion.
Right-click Forward Lookup Zones (or Reverse), select New Zone.
In the wizard, select Secondary zone.
Enter the zone name exactly as it was (e.g., example.com).
On the Master DNS Servers page, enter the IP of the primary DNS server that holds the real zone.
Finish the wizard. The zone should now appear with a grayed-out icon (that's normal for secondary zones).
Right-click the zone and select Transfer from Master. You should see records populate.

Now test it. Try to change something on the primary server, do a zone transfer, and check that the secondary gets updated.

Fix 3: The Advanced Fix (15+ Minutes) - Registry or PowerShell Tweak

If the error keeps coming back, something's stuck in the server's configuration. This happens when the zone type is stored in the registry or Active Directory, and the DNS service can't sync it properly.

Step 1: Stop DNS and Clear the Zone from Registry

Open an admin Command Prompt (right-click, Run as administrator).
Type net stop dns and press Enter. DNS stops.
Open Registry Editor (regedit.exe).

Go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DNS Server\Zones

You'll see GUID-like folders under Zones. Each one is a zone.

Find the zone matching your error. Look under each GUID for a string called ZoneName to see which one it is.
Delete the entire GUID folder for that zone. Be careful: only delete the one you're sure about. Deleting the wrong one breaks other zones.
Close Registry Editor.
Type net start dns to restart DNS.

Now re-create the zone as secondary using the DNS Manager (follow Fix 2 steps 3-9).

Step 2: PowerShell Alternative (Same Result, Less GUI)

If you prefer commands, run PowerShell as admin and use this:

# Remove the zone (replace example.com with your zone)
Remove-DnsServerZone -Name "example.com" -Force

# Add it as secondary
Add-DnsServerSecondaryZone -Name "example.com" -ZoneFile "example.com.dns" -MasterServers 192.168.1.10

Replace 192.168.1.10 with your actual primary DNS server IP.

Why This Error Happens (Real-World Example)

Here's a scenario I dealt with last month. A sysadmin set up a new Windows Server 2019 to act as a secondary DNS for their domain. He ran the wizard, typed the zone name, and immediately got error 0x0000258D. Turned out the zone was already created as a primary zone by a script that ran during installation. We deleted and recreated it as secondary. Took 3 minutes.

Still Stuck?

Double-check your primary DNS server's IP is reachable. Try pinging it. Also make sure the primary server allows zone transfers to your secondary's IP. That's a common gotcha.

If nothing works, check the DNS event log for more details. Look in Event Viewer > Windows Logs > DNS Server. There might be a more specific reason code.