How to diagnose DNS problems on Windows endpoints, and fix them

1. Separate “no network” from “no names”

Test reachability to an address by number, then resolution of a name. Use a TCP port rather than ping, because plenty of networks drop ICMP.

Test-NetConnection 1.1.1.1 -Port 443
Resolve-DnsName example.com

2. See who the machine is asking

Get-DnsClientServerAddress -AddressFamily IPv4 | Where-Object { $_.ServerAddresses }
Get-NetIPConfiguration

Write the servers down before you change anything; you will want them for the undo. Then test each one on its own, which tells you whether the fault is the machine or a particular server.

Resolve-DnsName example.com -Server 10.0.0.10
Resolve-DnsName example.com -Server 1.1.1.1

Bypass the layers that hide the answer

A DNS diagnosis goes wrong when the tool you use is not asking the question you think it is. ping and browsers use the full Windows resolver, which also consults the hosts file, the local cache and, for some names, LLMNR and NetBIOS. Ask for DNS and only DNS:

Resolve-DnsName example.com -DnsOnly -Server 10.0.0.10
nslookup example.com 10.0.0.10

If the name resolves with -DnsOnly against a server but an application still fails, the fault is above DNS: the hosts file, a proxy, or the application's own resolver. If it fails here too, the server or the path to it is the problem.

The client also keeps its own record of lookups. The DNS Client operational log is the quickest way to see which name failed and against which server, but it may not be enabled, and turning it on is a configuration change you should note.

Get-WinEvent -LogName 'Microsoft-Windows-DNS-Client/Operational' -MaxEvents 30 -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Id, Message

3. The causes worth checking, in order

1. DHCP handed out a wrong or retired server. Compare against what the scope should give.
2. A static public resolver on a domain-joined machine. Internal names and Active Directory records only exist on your own DNS servers, so a machine pointed at a public resolver reaches the internet but cannot find the file server or a domain controller.
3. A VPN client rewrote resolution. Split-tunnel setups route some names to a different resolver. Get-DnsClientNrptPolicy shows name-based rules.
4. A hosts-file override. Get-Content $env:SystemRoot\System32\drivers\etc\hosts.
5. Stale cache. Get-DnsClientCache shows what the machine believes.
6. The server itself is down. If every client at the site fails against the same server, the endpoint is not the problem.

4. Fix the layer that is wrong

Clearing the cache changes nothing permanent, so it is the gentle first move:

Clear-DnsClientCache

Renewing a lease briefly drops and re-establishes the connection, which matters if you are working over it remotely:

ipconfig /renew

Returning an adapter to DHCP-supplied servers changes configuration. Note the old values first.

Set-DnsClientServerAddress -InterfaceAlias 'Ethernet' -ResetServerAddresses

On a domain-joined machine the right answer is almost never a public resolver; point it back at the domain's DNS servers.

5. Prove it with real lookups

Resolve one external name and one internal name, then test the thing the user actually complained about. A cache clear that “worked” because the next lookup was served from a fresh entry proves less than a lookup against each configured server.

Resolve-DnsName example.com -Type A
Resolve-DnsName yourfileserver.yourdomain.local
Get-DnsClientServerAddress -AddressFamily IPv4

When it is not the endpoint

If several machines at a site fail the same way, stop looking at this one. For Active Directory names specifically, check the domain controller's DNS role (dcdiag /test:dns from the controller) rather than touching clients.

There is an unedited example of RemediateDesk working this exact problem, with real timestamps, on the how it works page: it separates the adapter, the address and the resolver, confirms the configured server is unreachable, changes it, and re-resolves before saying it is fixed. Changing resolver settings is a state change, so it is proposed as an exact command and waits for approval; the AI technician for MSPs page explains that gate.

Watch it fixed in the product

The same three-command split is what the AI runs first on a machine that cannot load websites. How a proposed change is approved is covered in how approvals work, and a supported change can be reversed with undo.

Frequently asked questions