Fix DNS_ERROR_NAME_NOT_IN_ZONE (0x000025EA) in 5 steps

Quick answer

Delete and recreate the forward lookup zone for the exact domain causing the error, or fix the delegation so the NS record points to the right server.

What's going on

You're seeing error 0x000025EA – DNS_ERROR_NAME_NOT_IN_ZONE. This means the DNS server you queried got the request, but the requested hostname doesn't exist inside the zone it thinks it should be in. I've seen this dozens of times, usually after someone creates a forward lookup zone with a typo (like "contoso.com" instead of "contoso.local") or when a subdomain delegation gets broken after a server move. The culprit here is almost always a mismatched zone configuration, not a network issue.

For example, you try NSLOOKUP for server01.contoso.com, and the DNS server has a zone for contoso.net by mistake. The query lands in the wrong zone, and the server says "nope, that name's not here." Or you have a delegated subzone like sales.contoso.com that points to a different DNS server, but that server doesn't actually have the host records.

Fix steps

Verify the zone name – Open DNS Manager, expand your server, then Forward Lookup Zones. Right-click each zone, go to Properties, and check the zone name. Look for typos or extra dots. If you see contoso.com. with a trailing dot, that's a root hint issue – not your problem here. But if it's contso.com instead of contoso.com, you found your bug.
Check the host record – Inside the right zone, look for the exact hostname causing the error. If it's missing, create a new A or AAAA record. If it's there, make sure the IP address is correct and not pointing to a stale server.
Test delegation – If the error happens on a subdomain (like sub.contoso.com), right-click the parent zone, go to Properties > Name Servers. Verify the NS record points to a DNS server that actually has a zone for that subdomain. Then on that child DNS server, confirm the zone exists and has the host record.
Use NSLOOKUP with the right server – Run nslookup, then type server <IP> to target the DNS server that should have the record. Then query the hostname. If you still get the error, the server doesn't have that host in its zone.
Flush and reload – On the DNS server, run dnscmd /clearcache (or flush in DNS Manager). Also restart the DNS service with net stop dns && net start dns. This clears any stale cache that might show a wrong zone.

Alternative fixes if those don't work

Delete and recreate the zone – I've seen corrupted zone files that don't show in the GUI. Export the zone first (dnscmd /ZoneExport), delete it, then create a new primary zone with the same name and import the records.
Check AD-integrated zone replication – If your zones are AD-integrated, a replication failure can cause one DC to have a different zone list. Run repadmin /replsummary on all DNS servers to find replication errors.
Disable and re-enable the zone – In DNS Manager, right-click the zone, choose Properties > General, change the zone type to something else (like secondary), apply, then switch back to primary. This forces the zone to reload.

Prevention tip

Always double-check the zone name when creating it. Use a naming convention that matches the domain name exactly. If you manage multiple domains, keep a spreadsheet of all zones and their purpose. Also, set up DNS monitoring with a tool like dnscmd /Statistics or a third-party solution to alert you on zone errors before users complain.