How Windows chooses a DNS server

Windows applications using the system resolver can use local name information and the DNS client cache before querying a server. If a query is needed, interface configuration and name-resolution policy affect where it goes.

An alternate DNS server is primarily a fallback for an unresponsive server. It is not a second opinion that Windows necessarily consults after the preferred server returns NXDOMAIN. VPN policy, NRPT, multiple interfaces, and application-specific DNS-over-HTTPS can all affect the path.

Follow the resolution path

1. Check local name information and the DNS client cache. Hosts-file mappings are also loaded into that cache.
2. Select query destinations according to interface configuration, DNS suffixes, and applicable name-resolution policies.
3. Retry when servers do not respond. Multiple-interface and timeout behavior can involve parallel queries.
4. Consider mDNS, LLMNR, or NetBIOS only where the name type, application, and system policy make them relevant. They are not a universal final step in one fixed sequence.

Inspect multiple interfaces

Interface metrics are useful evidence, but do not independently determine every DNS query's destination:

Get-NetIPInterface | Sort-Object InterfaceMetric

A VPN can alter DNS servers, routes, and name-specific policy. Inspect Get-DnsClientNrptPolicy, split-DNS rules, and the actual query destination before changing priorities. Replacing corporate DNS with a public resolver can break internal names and is not a general fix.

Useful commands

# Inspect per-interface DNS servers.
Get-DnsClientServerAddress

# Inspect the resolver cache.
ipconfig /displaydns

# Clear the cache when stale entries are relevant.
ipconfig /flushdns

# Test an administrator-approved resolver without changing system settings.
Resolve-DnsName example.com -Server 192.0.2.53

# Change an interface metric only after confirming the intended routing effect.
Set-NetIPInterface -InterfaceAlias "Ethernet" -InterfaceMetric 10

192.0.2.53 is a documentation address; replace it with an approved resolver. Replace Ethernet with the actual interface alias. A lower metric affects interface preference, but still does not override all DNS policies or application resolvers.

FAQ

What happens when the hosts file and DNS disagree?

Applications using the Windows DNS client normally use the hosts mapping. A browser's own resolver, DoH implementation, or a direct DNS-query tool may behave differently. Check the application configuration.

Why did changing the DNS settings have no visible effect?

Confirm the application uses the system resolver. Inspect system and application caches, then NRPT and VPN policy. Avoid disabling an interface during remote troubleshooting unless you have another management path.

When is the alternate server queried?

Timeouts can cause queries to move to other configured servers. A negative response such as NXDOMAIN is a valid answer, not an invitation to combine answers from multiple resolvers. The exact retry sequence depends on interface and server configuration.

References: Windows DNS resolution, DNS client timeouts.

Related reading

• Add safe senders in Outlook
• Fix Docker’s “input device is not a TTY” error