Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a DNS server named Server1. Server1 hosts a DNS zone named fabrikam.com that was signed by DNSSEC. You need to ensure that all the member servers in the domain perform DNSSEC validation for the fabrikam.com namespace. What should you do?

To ensure that domain member servers perform DNSSEC validation for a specific namespace (in this case, fabrikam.com), you must configure the Name Resolution Policy Table (NRPT). The NRPT is managed centrally via Group Policy Objects (GPOs) and allows administrators to define specific rules for DNS domains. By adding an NRPT rule for fabrikam.com, you instruct the DNS clients on the member servers to require DNSSEC validation for any queries directed at that domain. Distributing this configuration via a GPO ensures that all member servers consistently enforce the validation requirement without needing manual configuration on each individual machine.

A: Adding a trust anchor on Server1 only configures the DNS server to validate DNSSEC, but it does not force the member servers (clients) to request validation. B: Trust anchors are configured on DNS servers to validate responses, not on standard member servers acting as DNS clients. Clients rely on the NRPT for validation rules. D: Network List Manager policies are used to identify networks and configure network-specific settings like firewall profiles, not to enforce DNSSEC validation rules for clients.

- Microsoft Learn, "The Name Resolution Policy Table (NRPT)", Windows Server DNS documentation. https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn593632(v=ws.11)

- Microsoft Learn, "Deploy DNSSEC with Windows Server", Windows Server documentation. https://learn.microsoft.com/en-us/windows-server/networking/dns/deploy/deploy-dnssec-with-windows-server