DNS Forwarder Already Exists (0X00002593) Fix

You're in the DNS Manager console on Windows Server (2012 R2 through 2022, doesn't matter), trying to add a conditional forwarder for internal.example.com to point to your partner's DNS servers. You right-click Conditional Forwarders, pick New Conditional Forwarder, fill in the domain name and IPs, click OK — and boom, you get this:

DNS_ERROR_FORWARDER_ALREADY_EXISTS
0X00002593
A conditional forwarding zone already exists for that name.

I've seen this happen more often than you'd think — usually when someone previously created a primary zone or a stub zone for the same domain name, and then forgot about it. Or another admin added the conditional forwarder from a different machine. The error is infuriating because the UI doesn't tell you exactly where the existing entry lives.

Here's what's really happening: DNS sees a conflict. You're trying to create a conditional forwarder, but a zone already exists with that exact domain name — either as a Primary zone, Secondary zone, Stub zone, or an existing conditional forwarder. DNS won't let you have two different zone types for the same domain. It's not broken; it's doing its job. But the fix is simple once you know where to look.

Root Cause

The root cause is almost always one of these three scenarios:

• A Primary, Secondary, or Stub zone already exists for that domain name. Conditional forwarders are stored as zones behind the scenes, so you can't overlay one.
• The conditional forwarder already exists — maybe added by another admin or from a previous attempt that partially succeeded.
• You're running the command from a server that holds a read-only copy of the zone (like a secondary server), and the master already has it. This is less common but I've seen it on poorly planned multi-site setups.

Fix: Delete the Conflicting Zone or Forwarder

Skip the dnscmd /ZoneAdd workaround — that'll fail too if the zone exists. The real fix is to delete the existing zone, then re-add the conditional forwarder. Here's how:

Step 1: Open DNS Manager

Press Win + R, type dnsmgmt.msc, hit Enter. Connect to the DNS server that threw the error if it's not the local one.

Step 2: Expand the server tree

Look under the server name, then expand Forward Lookup Zones. Scan the list for the domain name that matches your conditional forwarder — in this example, internal.example.com. It might be listed as a Primary Zone (looks like a folder icon with a globe) or a Stub Zone (folder with a dotted globe).

If you see it:

1. Right-click the zone.
2. Select Delete.
3. Confirm by clicking Yes.

If you don't see it there, check under Conditional Forwarders. If it's listed there, delete it the same way.

Step 3: Delete via command line (faster if you know the name)

Open an elevated Command Prompt (Run as Administrator) and run:

dnscmd . /ZoneDelete internal.example.com /f

Replace internal.example.com with your domain. The /f flag forces deletion without confirmation. This works even if the zone type is a conditional forwarder — they're all zones to the DNS engine.

After deletion, confirm it's gone:

dnscmd . /ZonePrint internal.example.com

You should get DNS_ERROR_ZONE_DOES_NOT_EXIST (9601) — that's your confirmation it's cleared.

Step 4: Re-create the conditional forwarder

Now go back to DNS Manager, right-click Conditional Forwarders, choose New Conditional Forwarder. Enter the domain name and IP addresses of the DNS servers you need to forward to. Check Store this conditional forwarder in Active Directory if you want it replicated (typically yes for domain-joined servers). Click OK.

Or use the command line:

dnscmd . /ZoneAdd internal.example.com /Forwarder 10.0.0.1 10.0.0.2

Add /DsPrimary if you want AD replication.

What to Check if It Still Fails

If you still see the error after deleting, here's what's likely happening:

• Replication lag: If you're using AD-integrated zones, the deletion might not have replicated to all DNS servers yet. Wait a few minutes or force replication with repadmin /syncall.
• You're on a secondary server: Check if the zone is actually stored on the master. Sometimes a secondary server won't let you delete a zone locally — you have to delete it from the master and let it replicate out.
• Another admin recreated it: Between your deletion and re-add, someone else added it back. Unlikely, but I've been in shops where that happened because of automated scripts. Check your change logs.
• ForestDNSZones or DomainDNSZones: On a domain controller, the zone might be stored in the Application Directory Partitions. Use dnscmd /EnumZones to see all zones, including those in hidden partitions. You might need to delete from there specifically.

That covers it. The error is a paper tiger — annoying, but easy to squash once you know the trick.