Fix DNS_ERROR_SECONDARY_DATA (0X000025F0) on Windows

Quick answer: Delete the corrupt secondary zone file, re-transfer the zone from the master, and verify with dnscmd /ZoneResetSecondaries.

I've seen this error way too many times in production. It usually pops up right after a DNS server reboot or a failed zone transfer. The secondary zone's local copy of the zone data is missing, unreadable, or just plain corrupt. Windows knows it's broken and refuses to load it, so you're left with a dead zone and a help desk full of angry users who can't resolve internal names. This tripped me up the first time I saw it – I spent an hour looking at permissions when the file itself was the problem.

Why This Happens

Every secondary zone on a Windows DNS server has a local database file stored in %systemroot%\system32\dns. The file name matches the zone name – like example.com.dns. When that file gets corrupted – maybe from a crash, a disk write error, or an interrupted transfer – the DNS service can't parse it. The result is error 0X000025F0 and the zone won't load. You'll see it in Event Viewer as event ID 410 or 411, and the server log will blame the secondary zone data.

How to Fix It

Here's the sequence that works in most cases. Run these steps in order – don't skip ahead.

Back up the current zone file. Even if it's corrupt, you might need it for a full transfer if the master is gone. Open an elevated command prompt and run:

copy C:\Windows\System32\dns\example.com.dns C:\DNS_backup\example.com.dns.bak

Delete the corrupt zone file. This forces Windows to treat the zone as empty and re-transfer everything from scratch. Be careful – this only works if the master is reachable and has the data.

del C:\Windows\System32\dns\example.com.dns

Reload the zone. Open DNS Manager, right-click the zone, and select Reload from Master. Or use the command:

dnscmd /ZoneReload example.com

Verify the zone is healthy. Check the event log for a success event (ID 410 with no error). Also run:

dnscmd /ZoneInfo example.com

Look for Zone type = Secondary and Zone state = Running.

If That Doesn't Work

Sometimes the master server is the real culprit. I've had cases where the master's serial number was stale or the zone data was missing entirely. Here's what to try next.

Check the Master Server's Zone

On the master DNS server, open DNS Manager and check that the zone exists and has records. If it's empty or the serial hasn't changed, fix that first. Then increment the serial number manually:

dnscmd /ZoneResetSecondaries example.com

This resets the secondary's notify list and forces a fresh transfer.

Flush the DNS Cache and Restart the Service

Sometimes the DNS service holds a stale reference to the old file. Stop the service, delete the file again, then start it.

net stop dns
del C:\Windows\System32\dns\example.com.dns
net start dns

After the service starts, it will see the zone is missing and trigger a transfer request.

Check File Permissions

If you added the zone manually or restored from backup, the file might have wrong ACLs. The DNS service runs under LocalSystem, so it needs read/write access. Reset permissions with:

icacls C:\Windows\System32\dns\example.com.dns /reset

Then restart DNS.

Prevention Tips

This error is almost always caused by an unclean shutdown or a disk problem. To avoid it in the future:

Run chkdsk on the DNS server's system drive quarterly – I've caught bad sectors before they took down a zone.
Make sure the DNS service is stopped before you back up or restore zone files – copying while the service is running is a recipe for corruption.
Set up a scheduled task to verify zone health daily. A simple PowerShell script that checks Get-DnsServerZone and alerts on any zone with a status of NotRunning works wonders.

The real fix here is to stop treating zone files as sacred. They're just cached copies – the master is the source of truth. Force a re-transfer, verify, and move on. You'll have this resolved in ten minutes, not an afternoon.