Set-DnsServerStubZone: change dns server stub zone with rollback checks
Microsoft states: “The Set-DnsServerStubZone cmdlet changes settings for an existing stub zone.”
Read the checklistDSE security knowledge hubMicrosoft 365 & Identity
Microsoft 365 & Identity
Knowledge
Page 26 of the DSE Microsoft 365 & Identity knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Microsoft 365 & Identity knowledge center
Clear guidance for Microsoft 365, Entra identity, account protection, collaboration, endpoint policy, and lifecycle changes.
DSE post stream
760 articlesMicrosoft 365 & Identity
Add-DnsServerZoneDelegation: stage additions to dns server zone delegation against recorded identity and DNS state
Microsoft states: “Adds a new delegated DNS zone to an existing zone.” It also states: “The Add-DnsServerZoneDelegation cmdlet adds a zone delegation to a Domain Name System (DNS) zone.”
Read the explainer
Add-DnsServerSigningKey: stage additions to dns server signing key with before-and-after evidence
Microsoft states: “The Add-DnsServerSigningKey cmdlet adds a Key Signing Key (KSK) or Zone Signing Key (ZSK) key to a Domain Name System (DNS) signed zone.”
Read the guide
Set-DnsServerClientSubnet: change dns server client subnet with bounded evidence
Microsoft states: “The Set-DnsServerClientSubnet cmdlet updates the IP addresses in a client subnet on a Domain Name System (DNS) server.”
Read the playbook
Remove-DnsServerRootHint: remove dns server root hint under AD/DNS change control
Microsoft states: “The Remove-DnsServerRootHint cmdlet removes root hints from the list of root hints on a Domain Name System (DNS) server.”
Read the briefing
Remove-DnsServerZoneDelegation: remove dns server zone delegation with rollback checks
Microsoft states: “Removes a name server or delegation from a DNS zone.” It also states: “The Remove-DnsServerZoneDelegation cmdlet removes a name server or delegation from a Domain Name System (DNS) zone.”
Read the checklist
Reset-DnsServerZoneKeyMasterRole: reset dns server zone key master role against recorded identity and DNS state
Microsoft states: “Transfers the role of Key Master for a DNS zone.” It also states: “The Reset-DnsServerZoneKeyMasterRole cmdlet transfers the role of DNS Security (DNSSEC) Key Master server.”
Read the explainer
Add-DnsServerDirectoryPartition: stage additions to dns server directory partition with before-and-after evidence
Microsoft states: “The Add-DnsServerDirectoryPartition cmdlet creates a Domain Name System (DNS) application directory partition.”
Read the guide
Invoke-DnsServerZoneSign: invoke dns server zone sign with bounded evidence
Microsoft states: “The Invoke-DnsServerZoneSign cmdlet signs a Domain Name System (DNS) server zone.”
Read the playbook
Step-DnsServerSigningKeyRollover: step dns server signing key rollover under AD/DNS change control
Microsoft states: “Rolls over a KSK that is waiting for a parent DS update.” It also states: “The Step-DnsServerSigningKeyRollover cmdlet rolls over a key signing key (KSK) that is waiting for an update from a parent delegation signer (DS).”
Read the briefing