Windows "The specified domain either does not exist or could not be contacted": it's usually DNS

1. Which DNS server is it using?

Get-DnsClientServerAddress -AddressFamily IPv4
ipconfig /all

Machines in a domain must use the domain’s DNS servers, and only those. A home router, 8.8.8.8 or 1.1.1.1 won’t do. Don’t add a public server as “secondary” either: Windows may use it at any time, and then the domain seems to disappear now and then.

Set it, or fix it on your DHCP server if that’s where it comes from:

Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 10.0.0.10, 10.0.0.11
ipconfig /flushdns

Get-NetAdapter lists the names, if yours isn’t Ethernet.

2. Can it find a domain controller?

This is exactly the question Windows asks:

nslookup -type=SRV _ldap._tcp.dc._msdcs.contoso.local

_ldap._tcp.dc._msdcs.contoso.local  SRV service location:
   priority  = 0
   port      = 389
   svr hostname = dc01.contoso.local

Or use the dedicated tool, which also tests the answer:

nltest /dsgetdc:contoso.local

Check the domain’s full name: contoso.local, rather than the short name, CONTOSO. A short name needs extra lookups that often fail, so use the full one when joining.

• Non-existent domain: a wrong DNS server (section 1), or a wrong name.
• Can't find ... on the right server: the records are missing on the domain controller (section 4).

3. Can it reach the domain controller?

DNS answers, and joining needs the network too:

Test-NetConnection dc01.contoso.local -Port 389
Test-NetConnection dc01.contoso.local -Port 445
Test-NetConnection dc01.contoso.local -Port 88

A failure means a firewall in between, or a VPN that doesn’t carry this traffic. A VPN often gives you its own DNS server too, so check ipconfig /all while it’s connected. The Port Lookup explains these ports. If 135 passes and joining still fails, see The RPC server is unavailable.

4. On the domain controller

If records are missing, make the domain controller register them again:

Get-Service DNS, Netlogon, NTDS, KDC | Format-Table Name, Status
Restart-Service Netlogon
ipconfig /registerdns
dcdiag /test:dns /v

Check that the domain controller points to itself, or to another domain controller, for DNS. A domain controller set to use a public server breaks in the same way.

5. Check the time

Kerberos refuses sign-ins when clocks differ by more than 5 minutes, and the message can then be misleading. Compare them:

w32tm /stripchart /computer:dc01.contoso.local /samples:3 /dataonly

Fix it:

w32tm /config /syncfromflags:domhier /update
Restart-Service w32time
w32tm /resync

Virtual machines that were suspended, or restored from a snapshot, are the usual suspects.

6. Then try the join

Add-Computer -DomainName contoso.local -Credential CONTOSO\admin -Restart

The -Server dc01.contoso.local option can name a domain controller directly, which helps rule out problems with finding one.

A machine that’s already joined and suddenly shows this has probably lost its DNS settings, or its VPN. If it’s the machine’s own account that’s broken, the message is different: see the trust relationship failed.