Windows Server 2008 DNS Block Feature

Windows Server 2008 introduces a DNS block feature that may affect the ISA Server automatic discovery mechanism when implementing WPAD using a Windows Server 2008 DNS Server.

The block feature provides a global query block list to reduce vulnerability associated with dynamic DNS updates. Dynamic update makes it possible for DNS client computers to register and dynamically update their resource records with a DNS server whenever a client changes its network address or host name.  This reduces the need for manual administration of zone records, especially for clients that frequently move or change locations and use DHCP to obtain an IP address. This convenience comes at a cost, however, because an authorized client can register any unused host name, even a host name that might have special significance for certain applications. This can allow a malicious user to "hijack" a special name and divert certain types of network traffic to that user's computer. WPAD is a commonly deployed protocol vulnerable to this type of hijacking, and by default WPAD look up is disabled by the blocking mechanism.

If you want to use WPAD with a Windows Server 2008 DNS, note the following behavior:

  • If WPAD entries are configured in DNS before the DNS server is upgraded to Windows Server 2008, no action is required.

  • If you configure or remove WPAD after you deploy the DNS server role on a server running Windows Server 2008, you must update the block list on all DNS servers that host the zones affected by the change. The affected zones are those where you registered the WPAD servers.

To update the block list, use the dnscmd command-line tool. Open a command line prompt, and do the following:

  • To check whether the global query block is enabled, type:

    • dnscmd /info /enableglobalqueryblocklist. A value of 1 is returned if the block list is enabled.

  • To display the host names in the current block list, type:

    • dnscmd /info /globalqueryblocklist

  • To disable the block list and ensure that the DNS Server service does not ignore queries for names in the block list, type:

    • dnscmd /config /enableglobalqueryblocklist 0

  • To remove all names from the block list, type:

    • dnscmd /config /globalqueryblocklist

For more information about the DNS block list feature and dnscmd commands, download the article "DNS Server Global Query Block List" from TechNet at

Rayne Wiselman

ISA Server User Education Team

Comments (8)
  1. Anonymous says:

    Esta es una de las típicas preguntas que siempre nos hacemos los IT Pros, los Developers y los Arquitectos. 

  2. Anonymous says:

    Vorige week was ik bij een klant die me vroeg om even te helpen bij het opzetten van WPAD records in

  3. Anonymous says:

    Last year Rayne Wiselman wrote in the ISABlog about the Windows Server 2008 DNS Block Feature and how

  4. Anonymous says:

    News Microsoft Internet Security and Acceleration Server The ISA Server Best Practices Analyzer (IsaBPA)

  5. Anonymous says:

    I just had to add a comment here, hoping to help people googling this subject.  With the DNS blacklist enabled (blocking WPAD) you’ll get a Windows Event ID 7600.  At this point, if you search Technet, Support, etc you’ll find nothing useful regarding Event ID 7600 and Windows 2008 DNS blocking the query.

    Thank you Rayne for publishing this here.  

  6. Richard Artes says:

    dnscmd /config /globalqueryblocklist

    gives this error?!?:

    DNS Server failed to reset registry property.

       Status = 5 (0x00000005)

    Command failed:  ERROR_ACCESS_DENIED     5    0x5

  7. Dave says:

    Try running the command prompt as Admin Richard 🙂

Comments are closed.

Skip to main content