DNS Server Won't Start? Root Hints Missing (0x0000255C)

Quick Answer

Delete the corrupted root hints file at %SystemRoot%\System32\dns\cache.dns, restart the DNS service, and let it rebuild automatically.

Why This Happens

Error 0x0000255C means the DNS server can't find valid root hints — the list of root servers it needs to resolve queries outside your domain. The culprit here is almost always a corrupted cache.dns file. I've seen this after failed Windows updates, rogue antivirus quarantining the file, or someone editing it by hand and botching the format. Sometimes it happens when you migrate a DNS role between servers and the file doesn't copy over right. Either way, the DNS service won't start until it gets a clean set of root hints.

This isn't a registry issue or a permissions problem — don't waste time chasing those. The fix is straightforward.

Fix Steps (Main Method)

1. Stop the DNS service. Open an admin PowerShell or CMD and run:

   net stop dns

2. Delete the cache.dns file. Navigate to %SystemRoot%\System32\dns\. Delete cache.dns. Don't rename it — delete it. The file will be recreated when the service starts.
3. Restart the DNS service. Run:

   net start dns

4. Verify root hints. Open DNS Manager, right-click the server, go to Properties → Root Hints. You should see a full list of root servers. If it's empty, you'll need the alternative fix below.

Alternative Fixes (If Main One Fails)

Rebuild Root Hints via PowerShell

If the automatic rebuild doesn't work, force a refresh:

dnscmd /ResetRootHints

Then restart the service.

Manual Root Hints Import

Grab a known-good copy of cache.dns from a working DNS server (same OS version). Place it in %SystemRoot%\System32\dns\ and restart the service. You can also download a fresh copy from IANA's root hints page — but only do that if you're comfortable with the format. One typo and you're back to square one.

Check for DNSSEC Corruption

If you're running DNSSEC and root hints fail after an update, try disabling DNSSEC temporarily:

dnscmd /Config /EnableDNSSEC 0

Restart DNS. If it starts, re-enable DNSSEC after confirming root hints are intact.

Prevention Tip

Back up cache.dns after any major OS update or DNS configuration change. Keep a copy on a network share or in your documentation folder. I also recommend setting a scheduled task weekly that runs dnscmd /ResetRootHints — it's overkill for most environments, but if you're paranoid like me, it keeps the file fresh. And for the love of all that is holy, don't edit cache.dns by hand unless you really know the format.