Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I trace the origin of a DNS resolution in Windows 7?

Hosts involved:

  • Windows 7 host WIN7 where I'm trying to remove the name-to-IP mapping
  • home router running a DHCP service
  • host ABC renamed to DEF

On a Windows 7 host, I had a name ABC mapped to an IP number via C:\Windows\System32\drivers\etc\hosts. I removed the mapping from the HOSTS file. I renamed the Linux computer ABC to DEF and had it re-register with the DHCP server running on the router station (a Synology product) using its new name. (Just in case the DHCP server on the router would use DHCP leases to also offer some name resolution services.)

I issued a ipconfig /flushdns on the Windows 7 host from an elevated command prompt. I even stopped the DNS cache using net stop dnscache.

[Update:] An nslookup abc returns Non-existent domain. The host DNS queries are relayed to is the router I mentioned above. [/Update]

And yet, a ping abc still resolves the bloody name to the wrong IP number, to the one I had removed the mapping for. What can I do to trace this issue to its root?

[Update 2:] I rebooted: the issue persists. I unplugged the Win7 host from the network. (Well, switched off WLAN.) The system still resolved abc to IP number, directly subsequent to an ipconfig /flushdns executed as Administrator. Which leads me to conclude that there is some local system cache that remains unaffected by ipconfig /flushdns. [/Update 2]

A related question (but confined to the cache flush issue, and just flushing doesn't solve the problem for me): How do I update / flush / reset my DNS records in Windows?

share|improve this question
up vote 1 down vote accepted

It's probably the NetBIOS name cache. Try purging it using nbtstat from an elevated command line window:

nbtstat -R

You might also wish to disable NetBIOS. This option is available on the WINS tab of the Advanced TCP/IP Settings dialog.

share|improve this answer
This is it. But in a way that is somewhat embarrassing to reveal. Almost a year ago, I tried to figure out the NetBIOS business but never really properly understood it. Not disposing of a WINS server, I discovered you could have a substitute in editing the LMHOSTS file, which lives right next to the HOSTS file. So that's what I did. And that's what the entry for abc came from. It was bound to hit me with a vengeance when I would have forgotten about my dabbling with NetBIOS. Thank you for pointing me there. – Lumi Jun 11 '12 at 22:41

Running nslookup will show you the name resolution using responses of the current (normally the "primary") name server.

It's my normal first step when troubleshooting name resolution problems in Windows, especially when messing with HOSTS file entries and having to flush the dns cache.

share|improve this answer
In Windows 8/Server 2012 (or generally PowerShell 3.0), there seems to be the cmdlet Resolve-DNSname. – Oliver Salzburg Jun 11 '12 at 18:00
Forget to mention that nslookup abc returns Non-existent domain. The host DNS queries are relayed to is the router I mentioned in my description. The common home setup, a router/gateway to the Internet. – Lumi Jun 11 '12 at 18:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .