The 30-Second Fix: Check for Obvious Duplicates
I've seen this error pop up most often when someone tries to add an A record for www, but there's already an A record with that same name pointing somewhere else. Before you dig into command-line tools, open up DNS Manager (run dnsmgmt.msc on your DNS server).
Navigate to the forward lookup zone where you're seeing the error. Look for the record name you're trying to create. If you see two entries with the same name and type (e.g., two A records both called mail), that's your problem. Delete the wrong one.
Had a client last month whose intern copied a zone file and created a duplicate A record. He spent an hour on the phone with Microsoft support before I showed him this.
If you don't see two records, move to the moderate fix.
The 5-Minute Fix: Scan with DNSCMD
Sometimes the DNS Manager doesn't show duplicates because they're in different zones or hidden by AD integration. Use dnscmd from an elevated command prompt to list all records for that name:
dnscmd /EnumRecords [zonename] . /Name [recordname]Replace [zonename] with your zone (like contoso.com) and [recordname] with the name that's failing (like www). Here's an example:
dnscmd /EnumRecords contoso.com . /Name wwwThis spits out all records for www in that zone. You'll see the type column (A, CNAME, MX, etc.). If you see two A records or an A and CNAME with the same name, that's the conflict. DNS won't let you have an A record and a CNAME record for the same name—that's actually the most common cause of error 0x00002553.
To delete the duplicate, use:
dnscmd /RecordDelete [zonename] [recordname] [recordtype] [data]For example, to delete an A record for www pointing to 192.168.1.10:
dnscmd /RecordDelete contoso.com www A 192.168.1.10It'll ask for confirmation unless you add /f to force it. I always add /f after double-checking the IP.
The Advanced Fix (15+ Minutes): Check AD Replication and Zone Scavenging
If the error persists, the problem could be in Active Directory-integrated zones. Duplicate records can get created when two DNS servers replicate and both have the same record. I've seen this happen after a domain controller restore.
First, run this to see all DNS servers that hold the zone:
dnscmd /ZoneInfo [zonename]Check the Replication scope line. If it's AD-integrated, the issue might be a lingering record from a deleted server. Use repadmin to check replication:
repadmin /replsum /bysrc /bydestLook for failures. If replication is broken, fix that first. Then clear the DNS cache on all DCs:
dnscmd /clearcacheIf you still see the error, enable scavenging. This cleans up stale records that might be causing conflicts. In DNS Manager, right-click the zone, go to Properties > General, and click Aging. Set the scavenging period to 7 days. It won't delete records that were updated recently, but it'll purge orphaned ones.
Another trick: export the zone to a text file and search for duplicates manually:
dnscmd /ZoneExport [zonename] [filename]Then open the .dns file in Notepad and look for lines starting with the same hostname. I did this for a law firm that had 12 duplicate SRV records from a misconfigured DHCP server.
If none of this works, stop the DNS service, delete the zone file (back it up first), restart the service, and recreate the zone from scratch. That's nuclear, but when replication is so broken that records keep reappearing, it's the only way.
One last thing: if this is a Windows DNS server running in a domain, check that the Netlogon service is running. If it's not, the DNS server might not register its own SRV records, causing conflicts when you try to add them manually.