Baseline Windows DNS-over-HTTPS events and counters separately from port 53

Treat this document as a focused evidence review: Baseline Windows DNS-over-HTTPS events and counters separately from port 53. Only the official source and traced locations below supply facts. Confirm applicability before acting.

Source fact:

The official Monitor DNS over HTTPS events and performance in DNS Server on Windows Server from Microsoft supports the following bounded statements:

• Windows DNS Server records DNS-over-HTTPS operational events in dedicated DNS Server event-log channels described by the page. The research record locates this support at Monitor events; Event channels and event IDs.
• Windows exposes separate DNS-over-HTTPS request, response, and dropped-request performance counters, and those counters reset when the DNS Server service restarts. The research record locates this support at Monitor performance; DNS-over-HTTPS performance counters; Note.

Do not import neighboring assumptions into the source record. The supported task is a scoped comparison involving Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles and the conditions the source actually describes.

What the source does not establish

These events and counters show Windows DNS-over-HTTPS activity and drops; they do not by themselves establish confidentiality, client adoption, root cause, or acceptable capacity. It does not establish a deployment’s current state, authorize a production change, prove compliance, or show that Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution are healthy. Documented options are review inputs, not universal mandates.

Applicability questions

• For source statement 1 at Monitor events; Event channels and event IDs, which observable configuration, record, or test can confirm applicability here?
• For source statement 2 at Monitor performance; DNS-over-HTTPS performance counters; Note, which observable configuration, record, or test can confirm applicability here?
• What inventory proves which parts of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles are in and out of scope?
• Which condition in Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution must be healthy before evidence is trustworthy?
• What result would disprove the working assumption and return the issue to the owner?

DSE recommendation:

DSE recommends using the cited source as the evidence anchor for this decision. Use a two-person review for the source interpretation and the resulting operational decision. Record the source location, examined part of Windows DNS servers, AD-integrated zones, policies, forwarders, logging channels, clients, and administrative roles, observed and expected states, owner, and reason for deviation.

If the review warrants change, use a bounded implementation with prerequisites, test population, monitoring, abort criteria, and a rehearsed reversal. Sequence checks for Active Directory replication, domain-controller health, service accounts, routing, time, certificates, and upstream resolution and sanitize protected material before retention.

Verification and evidence

Evidence should let another reviewer reproduce this decision. Retain observations beside the traced locations Monitor events; Event channels and event IDs; Monitor performance; DNS-over-HTTPS performance counters; Note. Favor PowerShell exports, zone and policy inventories, sanitized query tests, event-channel data, replication state, and rollback commands, linked to stable identifiers, time, and operator.

Retain the starting state, authorization, execution record, outcome, deviation, and final state as one review package. Move disruptive checks to an approved test path. Reopen the decision when versions, design, dependencies, ownership, or official guidance changes.

Official references

• Monitor DNS over HTTPS events and performance in DNS Server on Windows Server — Microsoft