The following question comes up from time to time and for various reasons. What is the expected name resolution behavior of the DNS client resolver on Windows XP or Windows Vista? This may be for a single or for multiple network interfaces. So I thought I would put together a brief overview of what you would see on the network for DNS name resolution for different interface configurations. I am including network captures of three different scenarios that illustrate the expected behavior. This is just a quick overview; there is additional documentation available that covers how the ordering of the Preferred and Alternate DNS servers can change per interface, so I am not going to cover that here.
A single network interface with a Preferred and Alternate DNS configured. Preferred - 192.168.0.10 Alternate - 192.168.0.100
From the capture you will see the following behavior:
Notice that the whole process takes about 15 seconds.
Two network interfaces each with a Preferred and Alternate DNS server configured. Interface 1: Preferred DNS server - 192.168.0.10 Alternate DNS server - 192.168.0.100
Interface 2: Preferred DNS server - 10.10.10.10 Alternate DNS server - 10.10.10.11
Again, notice that the whole process takes about 15 seconds.
Confused yet? If so, maybe this table will help simplify things. Let's say we have two interfaces, each with two DNS servers configured. The interfaces are numbered 1 and 2 and the DNS servers are A, B, C, and D.
Just for fun, let’s see what happens if you add additional DNS servers to the first interface. Interface 1: Preferred DNS server - 192.168.0.10 Alternate DNS server - 192.168.0.100 Additional DNS server - 192.168.0.200 Additional DNS server - 192.168.0.250
This is the same behavior as Scenario 2, we just have more DNS servers.
Notice that there are still only 5 queries and the whole process still takes about 15 seconds. It is not likely that many people would run into this particular scenario, but it is interesting to see how things behave.
Hope that helps clear up any questions.
- Clark Satter
Thanks for putting this together.
So there is only one question LEFT.
How is the interface selection done? Wich interface will be the first and the second, third,... one.
And how does this work if you have dynamic interfaces like VPN Adapters or Virtual Adapters?
Is there a change in this process with Win7 and W2008R2?
Can you comment on the DNS resolver behavior changes in Windows Vista with regard to the handling of responses that include IP addresses that appear to be unreachable from the local host?
Really good information Clark, I haevn't seen this documented this well anywhere else. This one is getting put into the favorites.
> So there is only one question LEFT.
> How is the interface selection done? Wich interface
> will be the first and the second, third,... one.
Any answers here? Windows 7 and Vista seem to prefer a VPN/PPP connection, but Windows XP would prefer ethernet/wireless connections.
I'd really like to get back the previous behavior.
Can you complicate it a bit more?
What happens if you've got more than one Domain suffix.
e.g. 2 Interfaces with each 2 DNS Servers and two DNS Suffixes
Interface 1 A,B Domain a.a,b.b 2 C,D Domain a.a,b.b
Query1 A a.a
Query2 A b.b or B a.a ??? C a.a ???
i have same question and i get the resolve method:
it is simple,
go to control pannel - > network connection -> advanced -> advaned config -> adapter and binding -> here you can change the network service order.
hope it is helpful.
I use chinese version,
sorry for my bad english.
how did you setup your test environment? i uses there dns servers in the list ,but it just try once
Interesting. I did not witness this behavior in Windows 8 (presumably previous versions as well). If the above article is correct, there would be NO scenario in which DNS queries are sent to a 3rd or 4th DNS server (on a single interface) without also sending the request to ALL other servers. I am witnessing requests sent to the fourth DNS server in a list, without bothering to contact server 1, 2 or 3. Perhaps there is a cache of non-responsive servers or something? I'll post back if I learn more...