Explain output of ipconfig /displaydns

Question

Can you please tell me what each field of the Windows command

ipconfig /displaydns

means please?

Answer 1

The fields in the output of /displaydns correspond to the fields of an actual DNS reply.

• In a DNS server's database, each piece of data is a "resource record".
• "Record name" is the name you query DNS for, and the records (addresses or something else) belong to that name.
• "Record type" is the type, displayed as a number - although more commonly they are referred to by their names, internally (in the DNS protocol) each has a number. Type 1 is "A" for "address", an IPv4 address. (IPv6 uses type 28, "AAAA", for an address four times as long.) "PTR", type 12, is a "pointer" to a hostname - most commonly used when mapping an IP address back to its name. "CNAME" is "canonical name".
• "Time To Live" is the time in seconds after which the cache entry must expire.
• "Data Length" appears to be the length in bytes - an IPv4 address is four bytes, IPv6 is sixteen bytes. For CNAME or PTR, Windows displays a static number (either 4 or 8, depending on your system) - this is actually the size of a memory address where the actual text is kept.
• The "answer" section of a DNS reply is the actual answer to the query, and "additional" contains information that will likely be needed to find the actual answer. For example, glue records.
• "<type> record" shows the actual value stored.

Answer 2

ipconfig /help says that this "Displays the contents of the DNS Resolver Cache".

The DNS resolver is what turns a domain name, like superuser.com, into an IP address, 64.34.119.12 for superuser.com.

This can take a second or two, but because IP addresses change infrequently the resolver caches (aka "saves") these entries locally on your computer. This means that the next time you make a connection to superuser.com, your computer doesn't need to make an external request for the IP address and the conversion from domain name to IP address is done in milliseconds instead of seconds.

The /displaydns option shows what is currently saved. This can be useful when a site seems not to be responding. It will be used more for technical types (and superusers) than average users.

Answer 3

cached domain
----------------------------------------
Record Name . . . . . : cached name
Record Type . . . . . : Record type I don't know which records types are cached exactly
Time To Live . . . . : TTL
Data Length . . . . . : ?? A records 4, CNAME usually 8, I didn't find info about this. Maybe IPv6 records have a different one.
Section . . . . . . . : Usually "Answer", there is an "Additional" section also
A (Host) Record . . . : IPv4 address
CNAME Record . . . . : domain (will check the address of this domain instead of the domain, CNAME records can have a very long TTL so its useful to avoid unnecessary queries.

Answer 4

That command displays your "local" DNS cache that is stored in Windows, this makes browsing faster because it keeps records for any website you have visited before, on your local hard drive, which means the browser does not have to wait for a DNS server out on the internet to resolve the address and pass that information back to your browser.

http://www.updatexp.com/dns-windows-xp.html

http://en.wikipedia.org/wiki/Domain_Name_System