Quick answer
Run repadmin /syncall /AdeP on the DNS server, then check dnsdiag and verify the DomainDnsZones and ForestDnsZones partitions exist in Active Directory. If they're missing, you'll need to rebuild them via dnscmd or a metadata cleanup.
What's actually happening here
The DNS_ERROR_DP_NOT_AVAILABLE (0X000026B1) error shows up when a DNS server tries to read or write to an Active Directory–integrated DNS zone but can't find the corresponding directory partition. This typically happens on a domain controller running Windows Server 2012 R2 through 2022. The underlying cause is almost always replication failure — either the partition's msDS-NC-Replica-Locations attribute hasn't replicated to all domain controllers, or the partition itself got corrupted or deleted.
I've seen this most often after a domain controller was forcefully demoted without proper cleanup, or when a sysadmin accidentally ran dnscmd against the wrong server. The DNS service keels over because it expects those partitions to exist — they store the zone data. Without them, the server can't serve any AD-integrated zones.
Numbered fix steps
- Check which partition is missing. Open Event Viewer, go to DNS Server logs, and look for event ID 4000 or 4015. The event details will name the partition — usually
DomainDnsZonesorForestDnsZones. Alternatively, run:
If you see zones with a status of “Failed” or “Unavailable”, that's your culprit.dnscmd /EnumZones - Verify replication health. On the affected DNS server, run:
Look for any failures under the partition that's causing the error. If you see “last success” older than the tombstone lifetime (default 180 days), the partition may have been garbage-collected. That's bad — means it's gone from AD entirely.repadmin /showrepl - Force a replication sync. Even if replication looks healthy, force it:
Therepadmin /syncall /AdeP/AdePflag ensures it syncs all partitions, including the directory partitions. Wait 5 minutes, then check the DNS error again. If it clears, you dodged a bullet — it was just a delay. - If step 3 didn't help, check the partition object itself. On a working domain controller (preferably the PDC emulator), run:
Replace with your domain DN. If you get “object not found”, the partition is truly gone. You'll need to recreate it.repadmin /showobj * "CN=DomainDnsZones,CN=System,DC=yourdomain,DC=com" - Recreate the missing partition. This is the nuclear option — do it only if you're sure the partition is gone. On the PDC emulator, run:
Then run:dnscmd /CreateDirectoryPartition DomainDnsZones.yourdomain.com
Wait 15 minutes for replication, then rundnscmd /CreateDirectoryPartition ForestDnsZones.yourdomain.comrepadmin /syncall /AdePacross all domain controllers.
Alternative fixes if the main steps fail
- Restart the DNS service — sounds basic, but I've seen it shake loose a stale handle:
net stop dns && net start dns - Check the Netlogon service — it registers the SRV records for the partitions. If it's not running or misconfigured, DNS won't know where to look:
net start | findstr Netlogon - Demote and re-promote the domain controller — if the partition is corrupted beyond repair, this is the cleanest fix. Demote via Server Manager, clean up metadata with
ntdsutil, then re-promote. Yes, it's painful, but it guarantees a clean partition structure. - Use
dnsdiag(from RSAT) to test DNS health:
It'll tell you exactly which zones are failing and why.dnsdiag /test:dns
Prevention tip
Set up daily replication monitoring with repadmin /syncall /AdeP in a scheduled task. If a partition fails to sync for more than 48 hours, alert yourself. The worst time to discover a missing DNS partition is during an outage — it compounds the misery. Also, never, ever force-demote a domain controller without running ntdsutil metadata cleanup afterward. That's how partitions vanish.