Error 0x0000232B RCODE_NAME_ERROR when joining a domain: how to fix it

Applies to: Windows 11, Windows 10 and Windows Server joining an Active Directory domain. You need local administrator rights on the PC and a domain account that is allowed to join computers.

What the error means

The full message usually reads: “An Active Directory Domain Controller (AD DC) for the domain could not be contacted”, followed by details saying the DNS query for an SRV record such as _ldap._tcp.dc._msdcs.corp.example.com failed with DNS name does not exist (error code 0x0000232B RCODE_NAME_ERROR).

To join a domain, Windows asks its DNS server where the domain controllers are. RCODE_NAME_ERROR is the DNS server’s answer: it has never heard of that name. The common reasons are:

• Wrong DNS server. The PC gets DNS from the router (DHCP) or uses a public server like 8.8.8.8, which knows nothing about your internal domain.
• Wrong domain name. You typed the short (NetBIOS) name or a typo, so the lookup asks for a name that doesn’t exist.
• Missing SRV records. The domain controller never registered its records in DNS, so even the right DNS server can’t answer.

Point the PC’s DNS at the domain controller

1. Find the IP address of a domain controller that runs DNS (ask your admin, or run ipconfig on the domain controller).
2. On the PC, press Win + R, type ncpa.cpl and press Enter.
3. Right-click the active adapter (Ethernet or Wi-Fi) and choose Properties.
4. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
5. Choose Use the following DNS server addresses, enter the domain controller’s IP as Preferred DNS server and, if you have one, a second domain controller as Alternate. Don’t put a public DNS server here.
6. Click OK, then open Command Prompt and run ipconfig /flushdns.

On Windows 11 you can also do this in Settings > Network & internet > Ethernet (or Wi-Fi) > DNS server assignment > Edit. In an office, the cleaner long-term fix is to have DHCP hand out the domain controllers as DNS servers. If the adapter has no valid address at all, fix that first with Ethernet doesn’t have a valid IP configuration.

Test that the domain can be found

Before you try the join again, check the lookup that failed. In Command Prompt run (with your own domain name):

nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.example.com

A working answer lists one or more domain controllers with port 389. If you still get Non-existent domain, check which server answered: the first lines of the output show it. If it isn’t your domain controller, the DNS setting above didn’t take, or a VPN or second adapter is overriding it. You can also run nltest /dsgetdc:corp.example.com to see whether Windows can locate a domain controller.

Use the full domain name

In Settings > System > About > Domain or workgroup (or sysdm.cpl > Change), enter the full DNS name of the domain, such as corp.example.com, not only the short name like CORP. If you aren’t sure of it, run echo %USERDNSDOMAIN% on a PC that is already joined, or check Active Directory Domains and Trusts on the domain controller.

Joining from PowerShell gives the same result and a clearer error: Add-Computer -DomainName corp.example.com -Restart (run as administrator).

Fix missing records on the domain controller

If the PC uses the right DNS server and the SRV lookup still fails, the problem is on the server side. On the domain controller, as an administrator:

1. Check that its own network adapter uses itself (or another domain controller) for DNS, not a public server.
2. Restart the Netlogon service, which re-registers the domain controller’s DNS records: net stop netlogon and then net start netlogon.
3. Run ipconfig /registerdns, then dcdiag /test:dns and fix anything it reports.
4. In DNS Manager, confirm the forward lookup zone for the domain exists and contains the _msdcs records.

If the PC joined before and now shows other domain errors, see “The trust relationship between this workstation and the primary domain failed”.

Azure and cloud domains

For a virtual machine joining Microsoft Entra Domain Services (formerly Azure AD DS) or a domain controller hosted in Azure, the DNS servers are set on the virtual network, not only on the VM. Set the virtual network’s DNS servers to the managed domain’s IP addresses (shown on its overview page), restart the VM so it picks them up, and try again. Note that joining a device to Microsoft Entra ID itself (Settings > Accounts > Access work or school) doesn’t use this DNS lookup; hybrid join problems are covered in Automatic registration failed at join phase.

Related guides

• The trust relationship between this workstation and the primary domain failed
• Ethernet doesn’t have a valid IP configuration: 7 fixes
• DNS_PROBE_FINISHED_BAD_CONFIG: how to fix it
• Automatic registration failed at join phase

Official sources: for more detail, see Microsoft’s own pages:

• Microsoft Learn: Active Directory domain join troubleshooting guidance
• Microsoft Learn: Cannot join a computer to a domain

Frequently asked questions

Can I just add the domain to the hosts file?

No. The hosts file can map a name to an address, but it can’t answer the SRV queries that a domain join needs. Point the PC at the domain’s DNS server instead.

Do I need to remove my router as the DNS server?

On a domain-joined PC, yes. Use only domain controllers as DNS servers; they forward internet lookups for you. Mixing in the router or a public server causes intermittent domain errors.

Does a VPN affect this error?

It can. When you join over a VPN, the VPN adapter must hand out the domain’s DNS servers. If the join works in the office but not on VPN, ask your admin to check the VPN’s DNS settings.