Recommended Free Tools
Short answer: treat an unsupported Windows Server DNS host as a migration emergency, not a system that can be made permanently safe with one setting. Windows Server 2012 and 2012 R2 stopped receiving ordinary support on October 10, 2023, and the final Extended Security Updates (ESU) period ended October 13, 2026. As of October 17, 2026, a 2012-era server should be assumed to be outside Microsoft’s security-update window unless you have verified a different, currently supported arrangement. Until you migrate, reduce exposure, disable recursion when it is not required, apply the exact Microsoft fix for the vulnerability and build involved, and monitor the service closely.
These controls lower the chance of exploitation; they do not repair vulnerable DNS code. Microsoft’s durable remedy is moving the DNS role to a supported platform, with Windows Server 2022 named as an on-premises upgrade target.
As an Amazon Associate I earn from qualifying purchases.
What “unsupported” means for a Windows DNS server
When Microsoft support ends, the operating system does not stop working. DNS may continue answering queries, Active Directory may continue authenticating users, and applications may appear normal. The risk is that newly discovered defects no longer receive the routine fixes that would normally close them.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Microsoft lists the following end-of-support consequences for Windows Server 2012 and Windows Server 2012 R2:
#1 Best Overall
- Server 2022 Standard 16 Core
| Milestone | What it means |
|---|---|
| October 10, 2023 | Regular support ended. Normal security updates, non-security updates, bug fixes, technical support, and online technical-content updates stopped. |
| Up to three years of ESU | Eligible installations could receive a limited set of security updates during a defined transition period. ESU did not restore general product support. |
| October 13, 2026 | The final Windows Server 2012/2012 R2 ESU period ended. Microsoft says devices on these versions no longer receive security updates containing protection from the latest threats after this date. |
Therefore, a firewall rule or a disabled feature should be considered a temporary containment measure. It is not equivalent to running a supported operating system.
Why DNS can be an RCE entry point
DNS is often reachable by every workstation, server, application, and network device that needs name resolution. A flaw in the DNS Server role can consequently expose a highly trusted machine, especially when that machine is also a domain controller.
CVE-2020-1350
Microsoft classified CVE-2020-1350 as a Critical Remote Code Execution vulnerability affecting Windows servers configured with the DNS Server role. The attack uses specially crafted DNS requests. Microsoft’s preferred remediation is the security update applicable to the installed operating-system build. The advisory also documents a registry-based workaround that can be applied without restarting, but that workaround is specific to the vulnerability and must match Microsoft’s instructions for the build.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The earlier MS16-071 example
Microsoft’s MS16-071 bulletin described a remote-code-execution vulnerability in Windows DNS servers that failed to handle requests correctly. The bulletin stated that an unauthenticated attacker could send malicious requests and, if successful, execute arbitrary code in the context of the Local System Account. This illustrates why an apparently simple resolver can represent a high-impact attack surface.
Rank #2
- 64 bit | 1 Server with 16 or less processor cores | provides 2 VMs
- For physical or minimally virtualized environments
- Requires Windows Server 2025 User and/or Device Client Access Licenses (CALs) | No CALs are included
- Core-based licensing | Additional license packs required for servers with more than 16 processor cores or to add VMs | 2 VMs whenever all processor cores are licensed.
- Product ships in plain envelope | Activation key is located under scratch-off area on label |Beware of counterfeits | Genuine Windows Server software is branded by Microsoft only.
Why recursion advice needs qualification
Microsoft’s MSRC explanation for a separate DNS issue noted that a server with recursion enabled and reachable by potential attackers should be patched. It also observed that an authoritative-only server with recursion disabled was technically not vulnerable to that specific 2011 issue. That observation does not establish that disabling recursion fixes every DNS vulnerability, including CVE-2020-1350. Use recursion settings as risk reduction, while still applying the applicable update or moving the role.
Start with an exact inventory
Do not change settings until you know what the host is doing. A DNS server can be authoritative for internal or public zones, recursive for clients, a forwarder for another resolver, an Active Directory domain controller, or several of these at once.
Record the operating-system state
- Windows edition, installation type, and full build number.
- Whether the installation is Windows Server 2012 or 2012 R2, and whether ESU was ever enrolled.
- Installed security updates and the date of the most recent update.
- Physical or virtual hardware, supported hypervisor status, available disk space, and backup location.
PowerShell’s Get-ComputerInfo can help capture operating-system details. Preserve the output with the change record rather than relying on a screen capture.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Record the DNS configuration
- All forward and reverse lookup zones, including whether each is primary, secondary, stub, or Active Directory-integrated.
- Recursion status, forwarders, root-hints use, conditional forwarders, and any query filters.
- Listening interfaces and IPv4/IPv6 addresses.
- Zone-transfer partners, notify settings, dynamic-update policy, scavenging, and DNSSEC configuration if used.
- Whether the server is a domain controller and which AD sites, subnets, and replication partners depend on it.
Useful built-in queries include Get-DnsServerZone, Get-DnsServerRecursion, and Get-DnsServerForwarder. Validate their output against DNS Manager and your network diagrams; stale documentation is a common source of accidental outages.
Rank #3
- Server 2025 will be delivered by post, FPP version
- Enterprise Security – Built-in advanced security features including Hotpatching for seamless updates and Credential Guard to protect against unauthorized access.
- Hybrid Cloud Integration – Connects seamlessly with cloud-based services for efficient management of on-premise and cloud infrastructure
- Optimized Performance – Enhanced networking and storage capabilities with improved data handling and support for high-performance workloads
- User-Friendly Interface – A modernized desktop experience with streamlined management tools such as WinGet and Terminal.
Map the build to the vulnerability
For each security advisory, check the affected-product list and the Knowledge Base package that applies to your exact edition and build. Do not install a package merely because its title contains “DNS” or because it was released for another Windows Server generation. Keep a copy of the advisory, package identifier, installation result, and reboot requirement in the change record.
Reduce network exposure before migration
Most temporary protection comes from ensuring that only the networks that genuinely need DNS can reach it.
Allow only required DNS clients
- List approved client networks, recursive resolvers, zone-transfer partners, monitoring systems, and administration networks.
- On the firewall closest to the server, allow UDP port 53 from approved DNS clients. Allow TCP port 53 as well; DNS uses TCP for large responses, truncated UDP responses, zone transfers, and other operations.
- Permit TCP 53 from only the secondary servers or transfer partners that require it if the host is authoritative.
- Restrict administrative protocols such as Remote Desktop, WinRM, and SMB to a management network or jump host. Never use public Internet access as an administrative shortcut.
- Remove broad “any source” rules and old NAT or port-forwarding entries that are no longer documented.
Apply equivalent controls on host-based Windows Defender Firewall where appropriate, but avoid creating contradictory rules between host and perimeter firewalls. Test from an approved client and from a deliberately unapproved network so that a rule that looks restrictive is proven to be restrictive.
Remove unnecessary Internet exposure
An internal recursive resolver normally has no reason to accept queries from the Internet. An authoritative public DNS server may need Internet reachability, but it should expose only the authoritative service and should not also provide open recursion. If a legacy host currently performs both functions, prioritize separating them.
Rank #4
- Offers quick and easy installation on PC
- The software is licensed for 5 User CAL
Disable recursion when the role is authoritative-only
Recursion makes a server answer questions by querying other DNS servers. It is useful for client resolution but unnecessary for a server that only publishes its own authoritative zones. Disabling it reduces the requests the host will process and prevents the server from becoming an open resolver.
Confirm the dependency first
- Check DHCP scopes, static resolver settings, application configuration, and domain-controller settings for clients that use this host.
- Identify forwarders and conditional forwarders that would stop working when recursion is disabled.
- Confirm that every client needing external name resolution has another approved recursive resolver.
Change and verify the setting
In an approved maintenance window, use the DNS Server PowerShell module’s Set-DnsServerRecursion -Enable $false on an authoritative-only server, or use the equivalent “disable recursion” option in DNS Manager. The graphical setting may also disable forwarders, so record the existing configuration before changing it.
After the change, query an authoritative zone that the server hosts and separately test a name outside those zones. The first should continue to resolve; the second should fail or be answered by the alternate resolver, according to your design. If applications fail, restore the previous setting and correct client resolver assignments before trying again.
Free tools Windows power users keep installed
One-click scans. No signup required.
When recursion is required
If the server must remain recursive, limit recursion to approved client address ranges and place the function behind internal firewalls. A separate recursive resolver, isolated from public authoritative DNS and from critical domain-controller services, is preferable where your architecture and staffing permit. This is a defense-in-depth measure, not a substitute for patching.
Best Value
Apply the correct Microsoft fix or workaround
The security update remains the preferred response to a DNS RCE. Before installation, take a verified system-state and DNS configuration backup, confirm that you can restore the virtual machine or physical server, and schedule a rollback window.
For CVE-2020-1350
- Confirm that the server runs the DNS Server role and that the installed build appears in Microsoft’s CVE-2020-1350 affected-product list.
- Obtain the security update package designated for that exact build through your approved update channel.
- Install it on a test or standby DNS server first when possible. Confirm DNS answers, Active Directory-integrated zone access, secure dynamic updates, forwarding, and transfers.
- Deploy to production under change control. Observe the advisory’s restart requirements and verify the installed package afterward.
- If the update cannot be installed immediately, use only the registry workaround documented in Microsoft’s CVE-2020-1350 advisory. Copy the exact value name, data type, and value from that advisory; do not substitute a value found in an unrelated article. Microsoft documents that workaround as not requiring a restart, but test service behavior and retain a rollback of the registry change.
A workaround that addresses CVE-2020-1350 does not guarantee protection from another DNS vulnerability. Reassess the server whenever a new advisory is issued.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Monitor for abuse and prove that DNS still works
Logs and alerts
- Review DNS Server events in Event Viewer under
Applications and Services Logs > Microsoft > Windows > DNS-Server. - Collect perimeter and Windows Firewall logs, including denied and unusually high-volume DNS traffic.
- Alert on sudden query-rate changes, malformed or unusually long requests, repeated requests from a new source range, unexpected zone-transfer attempts, and changes to recursion, forwarders, or listening interfaces.
- Correlate DNS activity with authentication, process-creation, and endpoint-protection alerts. Unexpected child processes or new services on a DNS server deserve immediate investigation.
Functional test after every change
- Resolve internal forward and reverse records from representative clients.
- Resolve external names through the approved recursive path, if recursion remains part of the design.
- Authenticate a test domain user and verify domain-controller locator records if the host is a DC.
- Perform a secure dynamic update with a test account, then confirm that unauthorized updates are rejected.
- Test secondary-server transfers and notification behavior if the server is authoritative.
- Stop or isolate the changed server and verify that documented secondary DNS servers provide the expected failover.
Contain a server that cannot be patched today
If an update is impossible because of application compatibility, maintenance restrictions, or a failed change, treat the host as vulnerable and shorten the migration deadline.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Place it in a segmented network with only the necessary DNS and management paths.
- Block Internet-originated queries unless a documented authoritative function requires them.
- Remove unused roles, services, software, scheduled tasks, and local administrator accounts.
- Use a dedicated management jump host and multifactor authentication where supported.
- Keep offline or otherwise protected backups of system state, DNS data, and configuration.
- Increase log retention and review frequency; define who is paged for suspicious DNS activity.
- Document an owner, target platform, migration date, and rollback plan. “Temporary” without a date tends to become permanent.
Isolation limits an attacker’s opportunities but does not make the vulnerable code safe. Continue treating the machine as a high-priority replacement.
Choose a migration path
Evaluate each option against support status, deployment time, DNS and AD compatibility, downtime, rollback, licensing, operational skills, and the ability to receive future security updates.
| Path | When it fits | Important checks | Limitation |
|---|---|---|---|
| Move or upgrade to Windows Server 2022 | On-premises environments that need Windows DNS and AD integration. Microsoft explicitly names Windows Server 2022 as an upgrade target. | Application and AD functional-level compatibility, edition and licensing, CAL requirements, hardware or hypervisor support, DNS data, secure updates, redundancy, and tested rollback. | Planning and migration effort; an in-place upgrade can complicate rollback and should not be the default for a critical DNS/DC host. |
| Move DNS to another supported platform | Organizations that can retire the legacy host or split authoritative and recursive services. | Zone transfer or replication method, ACLs, dynamic-update behavior, forwarding, DNSSEC if used, monitoring, and client resolver changes. | Different platforms may require new operational skills and tooling. |
| Use ESU as a bridge | Historically, eligible installations that needed limited time to migrate. | Edition, licensing, hosting model, enrollment route, and the exact update coverage. | The final Windows Server 2012/2012 R2 ESU period ended October 13, 2026. ESU never restored general support and is not available as a permanent strategy. |
A safer side-by-side migration runbook
- Build the destination. Deploy a supported Windows Server release, preferably Windows Server 2022 where it meets your compatibility requirements. Apply current updates before adding the DNS role.
- Design redundancy. Provide at least one additional DNS server appropriate to the zone type and AD site layout. Do not make the new host a single point of failure while retiring the old one.
- Install and configure DNS. Add the DNS Server role, configure listening addresses, forwarders or root hints, recursion policy, zone transfers, logging, and firewall rules. Match security settings intentionally rather than copying undocumented legacy behavior.
- Transfer zone data. For AD-integrated zones, add the new server to the correct domain and replication scope. For file-backed primary or secondary zones, transfer the zone through the supported mechanism and verify serial numbers, permissions, and transfer restrictions.
- Preserve dynamic updates. Test secure updates, DHCP registration, aging and scavenging, and the permissions used by applications. A zone that resolves static records but rejects secure updates is not a completed migration.
- Test clients and applications. Point a controlled set of clients and domain controllers at the new resolver. Exercise internal names, external names, reverse lookups, service records, authentication, and any hard-coded DNS dependencies.
- Shift traffic gradually. Update DHCP options, static server settings, load-balancer or virtual-IP membership, and delegation or registrar records as applicable. Monitor error rates before removing the old host.
- Retire safely. Remove the old server from zone name-server lists, AD DNS-server references, monitoring, and firewall rules only after the rollback period passes. Then uninstall the DNS role or decommission the operating system according to your records-retention policy.
How to treat ESU in the decision
Microsoft describes ESU as a last-resort transition option that supplies only defined security updates rated critical and important for a limited period. It does not provide ordinary troubleshooting, feature work, bug-fix support, or a return to the normal product lifecycle. Eligibility and enrollment depend on the exact edition and hosting model.
Because the final 2012/2012 R2 ESU date was October 13, 2026, organizations reading this after that date should not plan on ESU coverage for a still-running server. Verify the current Microsoft lifecycle status and any separately contracted arrangement, but plan on migration rather than assuming another extension.
Quick Recap
Decision checklist for the next change window
- Have you identified every zone, client network, forwarder, transfer partner, and management path?
- Is the host directly reachable from the Internet, and if so, is that exposure documented and necessary?
- Can recursion be disabled without breaking required clients or forwarders?
- Does the installed build match the Microsoft advisory and update package you intend to use?
- Do you have a tested backup and a rollback procedure?
- Have you tested AD-integrated zones, secure dynamic updates, transfers, and failover?
- Is a supported replacement assigned an owner and a date?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
