Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have two dns servers configured, which are listed when viewing ipconfig /all

I would like to know which of the two servers I am using at the current time i.e. from my browser or via the tracert command. I believe that I will be using the first listed server unless it is unavailable at which point I will be using the next one.

I am trying to find out if there is a command I can use which will tell me which one I am using, or alternatively an explanation as to why this is a flawed question.

I'm aware of ipconfig /displaydns but this is a cached result listing, which also doesn't show which server each result came from.

I'm aware of nslookup [host] but this uses the current "default" server.

I'm aware of nslookup [server] [host] but this doesn't help with confirming which dns I am currently using from tracert or browser.

My question comes from a situation where nslookup will give me the expected result for a particular internal host. Simultaneously, my browser, and also tracert are unable to resolve the host. If tracert and my browser are using the secondary dns server, I'd like to be able to confirm that.

Is there a way to do this?

share|improve this question

6 Answers 6

up vote 3 down vote accepted

Windows queries DNS in this order:

  1. Hosts file
  2. Local DNS cache
  3. Preferred DNS servers
  4. Other DNS servers (Secondary, Tertiary, ...)

You can find out more about this behavior over at Microsoft (How DNS query works, Client features). Additionally, there's also a list of timeouts for DNS requests:

Value        Default Value  Attempt
-------------------------------------------------------------------------------------
1st limit    1 second       Query the preferred DNS server on a preferred connection.
2nd limit    2 seconds      Query the preferred DNS server on all connections.
3rd limit    2 seconds      Query all DNS servers on all connections (1st attempt).
4th limit    4 seconds      Query all DNS servers on all connections (2nd attempt).
5th limit    8 seconds      Query all DNS servers on all connections (3rd attempt).
6th value    (Must be 0.)

Windows may log a DNS query timeout somewhere in the Event Viewer, I'm not sure about that. Wireshark mentioned by @BBlake probably is your best bet to quickly get your answer.

share|improve this answer

The DNSQuerySniffer utility from NirSoft will display the results of DNS queries as they happen, and includes the IP address of the DNS server.

http://www.nirsoft.net/utils/dns_query_sniffer.html

share|improve this answer

I guess the best solution is to go to dnsleaktest and click on Standard test. I use this method personally all the time.

share|improve this answer
    
Link doesn't work. –  Paul Matthews Jan 26 at 23:25
    
Yeah, seems to be down now, I've updated my answer with a new site. –  Gaurav Kumar Jan 27 at 16:00

The nslookup command from command prompt will tell you which one it is using (typically your primary). Sometimes typing in a fake domain (hdhsgdh.com) will fail on the first dns server and attempt to use the second.

A quick edit: don't type an address after The nslookup command, it will tell you which dns server it is using.

share|improve this answer

I believe you will always be using your primary dns server unless that fails. That's the reason we have alternate DNS aka secondary DNS server.

share|improve this answer
1  
If it has failed-over, how can I see that? –  Paul George Feb 17 '14 at 16:22

I am not aware of any easy way built in to Windows to track this information. However, a utility such as Wireshark makes it fairly easy to track your network traffic and filter by specific kinds of traffic, such as DNS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.