You're in the DNS Manager console on a Windows Server (2016, 2019, or 2022 — doesn't matter which), right-clicking to add a new forward lookup zone, and boom: the operation fails with DNS_ERROR_NOT_ALLOWED_ON_ROOT_SERVER (0X0000255A). Or maybe you're trying to create a new A record or a delegation, and it's the same wall. The exact trigger here is that the server you're targeting is configured as a root hints server — meaning it's listed in the RootHints zone (the . zone). The DNS service sees that and says "nope, root servers don't host custom zones." That's the whole story. It's not a permission issue, not a corrupted database, not a network problem. It's a design guard.
What's happening under the hood
DNS servers on Windows can have a special hidden zone called . (the root zone) which contains root hints — the list of top-level domain servers like a.root-servers.net. This zone is normally read-only and exists to tell your DNS where to forward queries it can't resolve locally. But here's the trap: if you've accidentally (or intentionally) created a forward lookup zone with the name . or if the server itself has been added as a root server in some other server's delegation, the DNS service marks the entire server as a root server. Once that flag is set, you can't create any other zones or records on that server. Microsoft's design reasoning is that real root servers (like the 13 operated by ICANN) must not host arbitrary data — and the DNS service enforces this even for your lab server.
The fix: remove the server from root hints
The fix is straightforward: you need to demote the server from root-hints status by removing the . zone or reconfiguring the root hints to point elsewhere. Do not try to delete the . zone from the UI — it's usually hidden. Here's the exact sequence:
- Open an elevated PowerShell or Command Prompt — right-click, run as admin. The DNS snap-in hides the root zone; the command line doesn't.
- Check the current root hints configuration by running:
dnscmd /enumzones
Look for a zone named.(just a dot). If it's there, that's your problem. - Remove the root hints zone:
dnscmd /zonedelete .
This deletes the.zone. The server will no longer treat itself as a root server. - Restart the DNS service:
Restart-Service DNS
This forces the server to reload its configuration without the root zone. - Verify: run
dnscmd /enumzonesagain — the.zone should be gone. Now go back to the DNS Manager and create that forward lookup zone you wanted. It'll work.
What to check if it still fails
If the error persists after removing the . zone, there's one more sneaky cause: the server might be configured as a root server in an upstream delegation. Open the DNS Manager, right-click the server, go to Properties > Root Hints. If you see your own server listed (or any server that points back to your IP), remove it and replace it with the standard ICANN root hints. You can get these from IANA's official list. Also check that no other DNS server on your network has delegated the root zone to this server — that'll also trigger the same error.
Another edge case: if you're running a lab environment with Active Directory integrated zones, make sure the forest root DNS server hasn't been accidentally configured as a root server during a migration. I've seen this happen when someone imported a Named.conf from BIND and it contained a root zone definition. The fix is the same — delete that zone and restart.
Bottom line: this error is the DNS service protecting you from yourself. Once you understand the guard, you work around it cleanly. Don't tinker with root hints unless you really mean it.