0

In Windows, there is a service named DNS Client service (dnscache) caches DNS names and registers the full computer name. When it is running only svchost.exe connects to DNS server. Then I stop and delete that service with the following process::

  1. Set dependency of Network Store Interface Service (NSI) to only Remote Procedure Call (RPCSS):: reg add "HKLM\SYSTEM\CurrentControlSet\Services\nsi" /V "DependOnService" /T REG_MULTI_SZ /D "RPCSS" /F

  2. Set dependency of Network Connectivity Assistant Service (NcaSvc) to only Base Filtering Engine (BFE):: reg add "HKLM\SYSTEM\CurrentControlSet\Services\NcaSvc" /V "DependOnService" /T REG_MULTI_SZ /D "BFE" /F

Set Services Dependencies

  1. Stop & Delete DNScache service:: sc stop "Dnscache" & sc delete "Dnscache"

Delete DNScache service

After deleteing DNScache service, every executable file which is connected to internet (including every browser) send & receive DNS packets (with netstat). With this process, it is obvious that Windows does not save dnscache. you can see that with ipconfig /displaydns.

Question: Why every executable sends DNS request after deleting DNScache service?

  • Your question title, and the question don't match - consider what you really are trying to ask here. As for why does it do look ups after deleting the service - consider it was doing look ups prior to deleting it too. – djsmiley2k Jun 28 '17 at 16:23
  • 2
    From what you say, it seems normal that if you remove a dns caching service then programs will send out dns queries: they can no longer interrogate the dns cache. – simlev Aug 1 '17 at 14:14
  • @simlev: Better put it up as an answer. There is no other answer. To the poster: I suggest that you undo the above changes. – harrymc Aug 1 '17 at 14:33
  • Based on this comment by the OP, this appears to be an XY problem, namely in that the OP is deleting the DNSCache service in order to be able to monitor DNS queries made by programs. There's a better way... – Twisty Impersonator Aug 2 '17 at 15:12
  • I (and I'm sure others) would be happy to have a look but you'll need to ask a new question. – Twisty Impersonator Aug 2 '17 at 15:29
7
+25

The behaviour you describe is precisely what you should expect. All DNS requests would normally be handled by the DNScache service, which would serve any application running on the same machine. After you delete it, all programs have to send out DNS queries, since they can no longer take advantage of the DNS caching service.

Information found online confirms that the DNScache service indeed does exactly what it is aptly named after: caching DNS queries.

What does the DNS Client (DNScache) service do? Resolving and caching domain names: it finds a domain name's IP address and saves this association for a short time.
What happens if it is disabled? If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached.


On a different note, what were you trying to accomplish by deleting the DNScache service? I fail to see any advantage or goal other than experimenting with the system to gain insight into its workings.

I would leave the Dnscache service alone.

  • 1
    By deleting dnscache service I get notified every time when a new app is trying to connect. Otherwise network monitor shows svchost.exe. This also helps me to resolve which exe associated with Windows telemetry. It also saves some RAM. – Biswapriyo Aug 1 '17 at 15:16
  • @Biswa Ok, it seems you have your reasons. So, is this behaviour satisfying for your needs? The RAM savings would not be substantial on a typical desktop pc, are you trying to create an embedded appliance? – simlev Aug 1 '17 at 15:19
  • If you want to know when apps are requesting internet connections you could use ZoneAlarm (on Windows) or Little Snitch (on Mac). – user1258361 Aug 7 '17 at 15:30
  • @Biswa Why did you not accept the answer and assign the bounty? What aspects did not satisfy you? – simlev Aug 9 '17 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.