Managing DNS records is an important part of maintaining a healthy Windows Server environment. If you manage an Active Directory domain, you may occasionally notice outdated DNS records that point to computers, servers, or devices that are no longer connected to your network. These stale records can create confusion, cause name resolution problems, and make DNS administration more difficult.
This is where DNS Scavenging comes in handy. It is a DNS Server feature that automatically identifies and removes outdated dynamic DNS records based on predefined aging and refresh settings. Instead of manually searching for old records and deleting them, you can configure DNS scavenging to handle eligible records automatically.
However, enabling this feature requires some planning. If you configure the aging intervals incorrectly or enable scavenging without checking your existing DNS records, you could remove records that are still needed.
In this guide, you’ll learn what DNS scavenging does, how aging and refresh intervals work, and how to enable and configure DNS scavenging in Active Directory-integrated DNS on Windows Server.
The instructions are suitable for administrators working with Windows Server 2016, 2019, 2022, and 2025, although some interface details may vary.
Let’s get started!
What is DNS Scavenging?
DNS Scavenging is an automatic cleanup mechanism available in Windows Server DNS. It identifies and removes stale DNS resource records that have not been refreshed within a specified period.
For example, imagine that a computer named PC-Accounting is connected to your Active Directory domain. It registers its hostname and IP address with DNS. Later, the computer is retired, but its DNS record remains in the DNS zone.
As a result, another computer might attempt to contact PC-Accounting using an IP address that is no longer valid. This can lead to failed connections and unnecessary DNS troubleshooting.
DNS scavenging helps prevent this situation by identifying records that have exceeded their configured aging period.
Understanding DNS Aging and Refresh Intervals
Before enabling scavenging, you should understand two important settings: No-Refresh Interval and Refresh Interval.
The No-Refresh Interval is the period during which a DNS record’s timestamp cannot be refreshed. This helps reduce unnecessary replication traffic in Active Directory-integrated DNS environments.
The Refresh Interval is the period during which a DNS client or server can refresh the record’s timestamp.
When the combined duration of these intervals has passed without a successful refresh, the record becomes eligible for scavenging. It is not necessarily deleted immediately. A scavenging operation must run, and the record must meet the applicable conditions.
For example, if you configure a seven-day No-Refresh Interval and a seven-day Refresh Interval, a record generally becomes eligible for scavenging after 14 days without a refresh.
Important: DNS scavenging does not automatically delete every record in your DNS zone. It primarily works with eligible dynamically registered records that have timestamps. Static records and records without timestamps are generally not scavenged.
Enable and Configure DNS Scavenging in Active Directory [Complete Guide]
To enable and configure DNS scavenging in Active Directory, follow these detailed steps:
1: Open DNS Manager on Your Windows Server
Before changing any DNS settings, sign in to a Windows Server computer using an account with the appropriate administrative permissions. You should ideally perform this task on the DNS server responsible for hosting your Active Directory-integrated DNS zones.
Open the Server Manager dashboard from the Start menu. Select Tools in the upper-right corner and choose DNS from the available administrative tools.
You can also press Windows + R, type dnsmgmt.msc, and press Enter to launch DNS Manager directly.
Follow this navigation path: Start > Server Manager > Tools > DNS.
Once DNS Manager opens, expand the server name in the left navigation pane. You should see folders such as Forward Lookup Zones, Reverse Lookup Zones, and Trust Points, depending on your configuration.
Take a moment to identify the DNS zones you want to manage. If you operate multiple domain controllers or DNS servers, confirm that you are working with the correct server before proceeding.
2: Review Your Existing DNS Zones
Before enabling DNS scavenging, inspect the DNS zones in your Active Directory environment. This is important because scavenging can delete outdated records, and you do not want to remove records that are still required by your network.
Expand Forward Lookup Zones and locate your Active Directory domain zone. Right-click the zone and select Properties to review its configuration.
Check whether the zone is Active Directory-integrated and whether dynamic updates are enabled. Secure dynamic updates are generally recommended for Active Directory-integrated zones because they help control which domain-joined computers can register and update their DNS records.
Follow this path: DNS Manager > Your DNS Server > Forward Lookup Zones > Your Domain > Properties.
You should also review reverse lookup zones if you want to manage their aging and scavenging behavior. Remember that each zone has its own configuration, so enabling scavenging for one zone does not automatically configure every other zone.
Before making changes, consider exporting or documenting important DNS records and existing settings. This provides a useful reference if you need to restore a record or investigate an unexpected result.
3: Enable Aging for Your Active Directory DNS Zone
Now that you have reviewed your DNS zone, it’s time to enable DNS aging. Remember, aging and scavenging are separate but related functions. Aging tracks record timestamps, while scavenging removes records that have become stale.
In DNS Manager, expand Forward Lookup Zones, right-click your Active Directory domain zone, and select Properties. Open the Aging tab and select Scavenge stale resource records.
You will see two configuration fields: No-Refresh Interval and Refresh Interval.
For most environments, the default setting of 7 days for each interval is a reasonable starting point. The combined period is 14 days, meaning a dynamically registered record generally becomes eligible for scavenging after 14 days without an accepted refresh.
Follow this path: DNS Manager > Forward Lookup Zones > Your Domain > Properties > Aging.
Select OK to save your settings. If you have multiple Active Directory-integrated DNS servers, the zone-level aging configuration replicates through Active Directory to the other DNS servers hosting that zone.
One important detail is that enabling aging for the first time gives the zone an additional protection period based on its refresh interval. This helps prevent records from being removed before clients have an opportunity to refresh their timestamps.
4: Enable Automatic DNS Scavenging on the Server
Enabling aging on a DNS zone is not enough. You must also enable automatic scavenging at the DNS server level.
In DNS Manager, right-click your DNS server name and select Properties. Open the Advanced tab and locate the option called Enable automatic scavenging of stale records.
Select the checkbox to enable it. Next, configure the Scavenging Period.
The default and recommended starting value is 7 days. This means the DNS server periodically checks eligible zones for records that have exceeded their aging intervals.
Use this navigation path: DNS Manager > DNS Server Name > Properties > Advanced > Enable automatic scavenging of stale records.
Click Apply and then OK to save the changes.
Remember that server-level scavenging settings do not automatically replicate to other DNS servers. If you have multiple DNS servers that should perform scavenging, configure the server-level setting individually on each one.
For easier administration, many organizations choose one designated DNS server to perform scavenging for a particular zone.
Configure Aging and Scavenging for Multiple Zones
If your Active Directory environment contains several DNS zones, configuring them individually can take time. Fortunately, DNS Manager provides an option to apply aging and scavenging settings across existing zones.
Right-click your DNS server name and select Set Aging/Scavenging for All Zones. Select Scavenge stale resource records and configure the No-Refresh and Refresh intervals.
After saving the settings, look for the option to apply these settings to existing Active Directory-integrated zones. Select it if you want the configuration applied to those existing zones.
Follow this path: DNS Manager > DNS Server Name > Set Aging/Scavenging for All Zones.
This option is particularly helpful when managing an established Active Directory environment with multiple integrated DNS zones.
However, don’t enable scavenging across every zone without reviewing its purpose. Some zones may contain records that require special handling or administrative protection.
Configure DNS Scavenging Using PowerShell
If you prefer command-line administration, you can configure DNS aging and scavenging using the DnsServer PowerShell module.
Open Windows PowerShell as an administrator on your DNS server. To enable aging for a specific Active Directory DNS zone, run the following command:
Set-DnsServerZoneAging -Name "contoso.com" -Aging $true -NoRefreshInterval 7.00:00:00 -RefreshInterval 7.00:00:00Replace contoso.com with your actual Active Directory DNS zone name.
Next, enable automatic scavenging on the DNS server and configure a seven-day scavenging period:
Set-DnsServerScavenging -ScavengingState $true -ScavengingInterval 7.00:00:00If you want to apply the server’s aging settings to existing zones, you can use the following command:
Set-DnsServerScavenging -ScavengingState $true -ScavengingInterval 7.00:00:00 -ApplyOnAllZonesTo review your server-level scavenging configuration, run:
Get-DnsServerScavengingTo check the aging configuration for a particular zone, run:
Get-DnsServerZoneAging -Name "contoso.com"The navigation and execution process is PowerShell > Run as Administrator > Configure Zone Aging > Enable Server Scavenging > Verify Settings.
These commands are especially useful when managing several Windows Server DNS environments or automating administrative tasks.
Protect Important DNS Records From Scavenging
Not every DNS record should be deleted automatically. For example, records associated with important servers, network appliances, printers, and critical services may need to remain available even if they do not receive regular dynamic updates.
DNS scavenging generally excludes records with a timestamp of zero. These are typically static records created manually by an administrator.
To protect an existing eligible record through DNS Manager, locate it in the appropriate DNS zone and open its Properties. Clear the Delete this record when it becomes stale checkbox, where available.
Follow this path: DNS Manager > Forward Lookup Zones > Your Domain > DNS Record > Properties.
Be careful when changing the timestamp of an existing record. Protecting a record from scavenging and changing its registration behavior are not necessarily the same thing. If a record is dynamically managed, consider its ownership and update permissions before making changes.
Never assume that all old records are unnecessary. Verify their purpose with the relevant system or application administrator before removing them.
Verify That DNS Scavenging Is Working
After configuring aging and scavenging, verify that the settings are active and that the DNS server is performing cleanup correctly.
Open DNS Manager and check the Aging tab of your configured zone. Confirm that Scavenge stale resource records remains selected and that the intervals match your intended configuration.
Next, open the DNS server’s Properties and check the Advanced tab to confirm that automatic scavenging is enabled.
You can also use PowerShell:
Get-DnsServerScavenging
Get-DnsServerZoneAging -Name "contoso.com"To review scavenging activity, open Event Viewer and navigate to Applications and Services Logs > DNS Server. Look for events such as 2501, which indicates that a scavenging cycle completed successfully, and 2502, which indicates that a cycle completed without deleting any records.
Follow this path: Event Viewer > Applications and Services Logs > DNS Server.
You can also manually initiate a scavenging operation using:
Start-DnsServerScavenging -VerboseThis command starts a scavenging pass immediately, but it does not bypass the zone eligibility period or record-aging requirements. It also does not change the automatic scavenging schedule.
Allow sufficient time for records to become eligible before expecting them to disappear.
FAQs
1. Is DNS scavenging enabled by default in Active Directory?
No. DNS aging and scavenging are disabled by default. You must enable aging on the DNS zone and automatic scavenging on the DNS server.
2. What are the recommended DNS scavenging intervals?
The commonly recommended starting configuration is a 7-day No-Refresh Interval, a 7-day Refresh Interval, and a 7-day Scavenging Period. However, adjust these values according to your DHCP lease duration, client registration behavior, and network requirements.
3. Does DNS scavenging delete static DNS records?
Generally, no. Static DNS records have a timestamp of zero, which excludes them from automatic scavenging. Dynamically registered records with nonzero timestamps can become eligible for deletion.
4. How often should DNS scavenging run?
A seven-day scavenging period is a common starting point. The server checks for eligible stale records according to this schedule. The exact deletion time depends on when the record becomes stale and when the next scavenging operation runs.
5. Can I enable DNS scavenging on multiple domain controllers?
Yes. However, remember that server-level scavenging settings do not replicate automatically. You must configure each DNS server separately if you want it to perform scavenging. You can also restrict which DNS servers are authorized to scavenge a particular zone.
6. How can I check whether DNS scavenging is enabled?
Open DNS Manager, right-click your DNS server, select Properties, and check the Advanced tab. You can also run Get-DnsServerScavenging in an elevated PowerShell session.
7. What happens if DNS scavenging is configured incorrectly?
Incorrect configuration can remove legitimate DNS records, causing computers and applications to experience name resolution problems. Always review existing records, verify dynamic registration, and back up your DNS configuration before enabling scavenging.
Final Words
DNS scavenging in Active Directory is an effective way to maintain clean DNS zones and remove outdated dynamic resource records. It reduces unnecessary DNS clutter and helps prevent clients from receiving outdated name resolution information.
To configure it correctly, enable aging on the required DNS zones, configure automatic scavenging on the DNS server, and select appropriate No-Refresh, Refresh, and Scavenging Period values.
Most importantly, don’t rush the process. Review your existing records, protect critical entries, and verify the results through PowerShell and Event Viewer.
With the right configuration and regular monitoring, you can keep your Windows Server DNS environment organized, reliable, and easier to manage.