← ALL SCRIPTS PowerShell · v1.0 · Safe-by-default

Remove-DnsRecordPair

Removes a DNS A record and its matching PTR record together as a single, validated operation — the natural cleanup companion to Invoke-ADDnsHealthCheck. Reads both records first, confirms they reference the same host/IP, then removes the pair only when -Apply is supplied.

Most ad-hoc one-liners delete only one side of a DNS record — which is exactly how forward and reverse zones drift out of sync and turn into the orphans your DNS audit flags. Remove-DnsRecordPair finds the A record by hostname, finds the matching PTR by IP, validates the pair before any change, then removes both sides atomically with full logging. -WhatIf and -Confirm are honoured, and an audit-mode default means nothing happens until you ask for it.

What it does
  • Finds the A record by hostname
  • Finds matching PTR by IP
  • Validates the pair before action
  • Removes A + PTR together
  • Audit mode by default
  • -Apply master safety gate
  • -WhatIf / -Confirm support
  • Single host or batch input
  • Targets a specific DNS server
  • Handles missing forward gracefully
  • Handles missing reverse gracefully
  • Pre/post verification logging
  • CSV action log per run
  • Skips records outside scope
  • Multi-domain forest support
  • Works with AD-integrated zones
PowerShell 5.1+ RSAT-DNS Audit -> Apply Forward + Reverse sync SupportsShouldProcess CSV action log
Get Script on GitHub

Opens github.com/rt109048/Remove-DnsRecordPair in a new tab

Get in touch

Let’s talk identity.

Open to advisory, contract and permanent opportunities involving Active Directory, Entra ID, identity governance, or zero-trust programmes. The best way to reach me is by email.

Location
United States — Remote