Fix DNS_ERROR_RECORD_ALREADY_EXISTS (0x000025EF)

You get this when trying to add a DNS record that's already there. The fix isn't always obvious — scavenging or stale zone data are usually the culprit.

When this error hits

You're adding an A or PTR record in DNS Manager on a Windows Server (2012 R2 through 2022, doesn't matter which), and you get the box: DNS record already exists with code 0x000025EF. Sometimes you're trying to register a DHCP client, sometimes you're manually adding a static entry for a new server. The server reports the record is there, but you can't see it in the zone. Or you can see it, but it's old and you want to overwrite it. The trigger is almost always a zone that hasn't been scavenged, or a record that was registered by an older domain controller and left behind.

Root cause

The DNS server is telling you the record already exists in its database. But you're not seeing it because it's either:

Stale and tombstoned — the record was deleted but the scavenger hasn't cleaned it fully.
Aging/scavenging is off — records pile up forever, and you can't add a new one with the same name.
Zone transfer or replication lag — the record exists on another DNS server but hasn't replicated to the one you're on.

The sneaky one: a NS or SOA record with the same name already exists in a different zone (like a reverse lookup zone). You're trying to create 10.0.0.50 in reverse, but there's already a PTR there pointing to a different host. The DNS server won't let you overwrite it without deleting first.

The fix (step by step)

Step 1: Find the hidden record

Don't rely on the GUI. Open PowerShell as admin and run:

Get-DnsServerResourceRecord -ZoneName "yourzone.local" -Name "hostname" -RRType A

If that returns nothing, try the reverse lookup zone too. You can also search all zones:

Get-DnsServerZone | Get-DnsServerResourceRecord -Name "hostname" -RRType A

Step 2: Check for scavenged (tombstoned) records

If you see nothing in the GUI, the record might be tombstoned. Run this to list all records including aged ones:

dnscmd /ZonePrint yourzone.local > C:\zone.txt

Open the file and look for the hostname. If it shows Aging: Scavenged or a timestamp older than the scavenging interval, that's your culprit.

Step 3: Force scavenging

You need to enable scavenging on the zone if it's off, then force a scavenge. In DNS Manager:

Right-click the zone, go to Properties.
Click Aging.
Check Scavenge stale resource records.
Set the refresh interval to a reasonable time (7 days is standard for most shops — adjust if needed).
Click OK.

Now force the scavenge:

dnscmd /ZoneResetScavengeServers yourzone.local
Clear-DnsServerCache -ZoneName yourzone.local
Start-DnsServerScavenging -ZoneName yourzone.local

Step 4: Delete the record manually with PowerShell

If scavenging doesn't clear it, delete the record directly (you'll need the record object):

$record = Get-DnsServerResourceRecord -ZoneName "yourzone.local" -Name "hostname" -RRType A
Remove-DnsServerResourceRecord -ZoneName "yourzone.local" -InputObject $record -Force

Then add the new record:

Add-DnsServerResourceRecordA -Name "hostname" -ZoneName "yourzone.local" -IPv4Address 192.168.1.100

Step 5: Check for DNSSEC or zone signing issues

If the zone is DNSSEC-signed, you can't modify records directly. Unsigned it first, make your changes, then re-sign. On a domain controller, run:

Set-DnsServerZone -Name "yourzone.local" -SigningType UnSigned
# make your change
Set-DnsServerZone -Name "yourzone.local" -SigningType Signed

This is rare but I've seen it catch people.

What to check if it still fails

Replication status: Run repadmin /replsum to see if the zone data is consistent across DCs. If replication is broken, the record might exist on another DNS server that hasn't sent updates.
Zone type: If it's a secondary zone, you can't add records there. You need to add them on the primary.
Case sensitivity: DNS is case-insensitive, but some older BIND zones treat it differently. Make sure the name matches exactly.
NetBIOS name conflicts: If the record is a PTR and there's a WINS registration for the same IP, that can block it. Check WINS if you're still using it.

If none of that works, blow away the zone and re-create it. That's the nuclear option, but I've had to do it twice in 14 years. Export the records first (dnscmd /ZoneExport) so you can reimport the ones you need.