DNS secondary zone needs master IP – fix 0X0000258C

When This Error Hits

You're on a Windows Server 2019 or 2022 box, right-clicking Secondary Zone under DNS Manager, and you punch in the zone name—say contoso.com—then click Next. That's when the error slams you: DNS_ERROR_SECONDARY_REQUIRES_MASTER_IP (0X0000258C). Or maybe you're running PowerShell fast and loose:

Add-DnsServerSecondaryZone -Name "contoso.com" -ZoneFile "contoso.com.dns"

Same error. You're missing the master server's IP address. I know—it's infuriating because the UI doesn't scream "you need this field" until it's too late.

Root Cause (Short and Sweet)

A secondary DNS zone is a read-only copy of a primary zone. It gets its data from a master DNS server via zone transfer. Without that master IP, the secondary zone doesn't know where to call home. The UI requires it before creation, but PowerShell lets you trip over this if you skip the -MasterServers parameter.

This error also shows up if you're using a stub zone misconfigured as secondary, or if you accidentally typed the IP in a wrong format (like 192.168.1.1/24 instead of 192.168.1.1).

Fix It: Step by Step

Option 1: Use DNS Manager GUI

1. Open DNS Manager (dnsmgmt.msc).
2. Right-click your server and choose New Zone.
3. Select Secondary Zone, then type the zone name.
4. On the Master DNS Servers page, click Add and type the master server's IP address (IPv4 or IPv6).
5. Finish the wizard. No more error.

Option 2: PowerShell (Recommended for Bulk)

Add-DnsServerSecondaryZone -Name "contoso.com" -ZoneFile "contoso.com.dns" -MasterServers 192.168.1.10

Replace 192.168.1.10 with your actual master IP. If you have multiple masters, use a comma:

Add-DnsServerSecondaryZone -Name "contoso.com" -ZoneFile "contoso.com.dns" -MasterServers 192.168.1.10, 10.0.0.5

Done. The zone creates instantly.

Option 3: Fix an Existing Broken Zone

If you somehow created a secondary zone without a master (unlikely, but possible via script), open DNS Manager, right-click the zone, go to Properties > Zone Transfers tab, and add the master IP under Allow zone transfers > Only to the following servers. Or just delete it and recreate correctly.

What to Check If It Still Fails

• Network reachability: Can your secondary server ping the master? Run ping 192.168.1.10. No reply? Check firewalls (DNS uses TCP and UDP 53).
• Zone transfer permissions: On the master DNS server, right-click the primary zone > Properties > Zone Transfers. Make sure Allow zone transfers is enabled and lists your secondary server's IP.
• DNS Notify: Sometimes the master needs a notify list. Add the secondary server IP under the Notify button in the same tab.
• IPv6 gotcha: If you're using IPv6, enclose the address in brackets in PowerShell: -MasterServers "[2001:db8::1]". The GUI handles it automatically.

I've seen this error stump even senior admins who forgot to add the master IP after a server rebuild. You won't now.