Windows Server · high · Directory & core infrastructure

AD replication error 8524 — the DSA operation cannot continue (DNS lookup failure)

A domain controller cannot resolve its replication partner's CNAME alias in the _msdcs zone, so replication stops. It is a DNS problem every time, never an Active Directory one.

What you see

repadmin /replsummary shows failures with error 8524. Event 1925 or 2087 in the Directory Service log. Changes made on one DC do not appear on another.

What is actually wrong

The partner's GUID-based CNAME record in _msdcs.<forest root> is missing or stale, the DC is pointing at the wrong DNS server, or the _msdcs zone is not replicating to the forest.

Codes and articles

85240x214CERROR_DS_DNS_LOOKUP_FAILURE

Fixes (2)

Fix the DC's own DNS client configuration

Elevated PowerShell on the failing DC20 minutesmedium riskreversible

One DC cannot replicate with anything. Its own resolver settings are the first thing to check.

Look at what the DC is using for DNS.

PowerShell

Get-DnsClientServerAddress -AddressFamily IPv4 | Format-Table InterfaceAlias, ServerAddresses -AutoSize

Correct it if wrong. A DC should point at another DC running DNS as primary, and at its own loopback as secondary — never at itself first, and never at a public resolver.
PowerShell
```
Set-DnsClientServerAddress -InterfaceAlias 'Ethernet' -ServerAddresses 10.0.0.11,127.0.0.1
```
A DC that lists only itself can start before its own DNS service is ready and cache negative answers for the whole domain. A public resolver knows nothing about the _msdcs zone at all.
Clear the resolver cache and re-register the DC's records.
PowerShell
```
Clear-DnsClientCacheipconfig /registerdnsnltest /dsregdns
```
Restart the Netlogon service to rewrite the SRV records.
PowerShell
```
Restart-Service Netlogon
```
Retest replication.
PowerShell
```
repadmin /replsummaryrepadmin /showrepl
```

Confirm it workeddcdiag passes its DNS and replication tests.

PowerShell

dcdiag /test:dns /vdcdiag /test:replications

If you need to undo itPut the previous DNS server addresses back with Set-DnsClientServerAddress.

Rebuild the missing _msdcs CNAME for the partner

Elevated PowerShell20 minuteslow riskreversible

One specific partner fails and the rest are fine.

Get the partner's directory server GUID.
PowerShell
```
repadmin /showrepl DC01 /repsto
```
Try to resolve the alias that GUID should have.
PowerShell
```
Resolve-DnsName -Name "<objectguid>._msdcs.example.local" -Type CNAME
```
This alias is how one DC finds another for replication. If it does not resolve, replication has no way to start, whatever else is healthy.
On the partner DC, force it to re-register its own records.
PowerShell
```
nltest /dsregdnsRestart-Service Netlogon
```
If the record still does not appear, confirm the _msdcs zone is present and is replicating to the whole forest.
PowerShell
```
Get-DnsServerZone | Where-Object ZoneName -like '*_msdcs*' | Format-List ZoneName, ReplicationScope, ZoneType
```
Force replication once the record resolves.
PowerShell
```
repadmin /syncall /AdeP
```

Confirm it workedrepadmin /replsummary shows no failures for that pair.

PowerShell

repadmin /replsummary

If you need to undo itNone — this adds DNS records that should exist.

Reference

Troubleshoot AD replication error 8524 — Microsoft Learn ↗

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.