Google DNS ( and are blocked (or polluted) by all ISPs available to me (and DNS by ISPs just return wrong answers for some sensitive sites!!), and it is said that if we change DNS from UDP onto TCP, the problem can be temporarily solved. How to use DNS over TCP in Windows 7?

  • 3
    What does "DNS on UDP is currently polluted in some regions" even mean? And how would changing a two-packet exchange into a nine-packet exchange help? – Spiff May 29 '11 at 15:58
  • 1
    @Spiff, we cannot use Google DNS ( and because they are blocked (and if we use DNS provided by our ISP, they just return wrong answers!), but some test results show that if we change DNS from UDP onto TCP, we are able to use Google DNS. – user69835 May 29 '11 at 18:34

Already answered at serverfault

  • You should have come earlier and thus I could have saved my reputation.... XD – user69835 Jun 25 '11 at 15:41
  • Be diligent and you will earn back even more reputation :D – bbaja42 Jun 25 '11 at 16:03
  • 1
    I'm giving your Answer a second upvote so you get the whole bounty. Don't say I never did anything for you. :-) – Spiff Jun 26 '11 at 4:10
  • 4
    Hang on, doesn't that link describe software for tunnelling TCP over DNS, doesn't the OP want to work the other way around by tunnelling their DNS over TCP to avoid DNS poisoning by their ISP? – DMA57361 Jun 26 '11 at 8:48
  • @DMA57361 Oh, you're right. I glanced at it too quickly. Oops. – Spiff Jun 26 '11 at 19:45

Another possibility that does not need software, is to use a DNS provider that your ISP does not know about, and so may possibly not block. This will work if your ISP is not sophisticated enough to block all DNS queries not aimed at its servers, and is rather opting for the easy solution of blocking Google DNS servers by their IP address.

Apart from Google Public DNS, there are several others of very good quality that are also free.

Examples are OpenDNS or DNS Advantage. In my case, I elected using DNS Advantage over my ISP, not because it is more correct, but simply because it is faster.

Another solution may be to use an outside VPN server to totally escape any sort of control by your ISP. High-speed VPN costs only a few dollars per month.


To be honest, if you are behind an ISP's firewall, chances that you can access those 'sensitive' sites by any means is rather small unless you have access to another machine outside the firewall (or purchase those VPN service, or use things like freenet/tor..)

An easy way, however, is to purchase a used kindle 3g which allows browsing through the built-in browser through a network not monitored by the great firewall.

Good luck!


As to me it seems none of the previous answers actually answer the question, I'll give it a try:

Tcp is the standard failover for dns requests if udp does not work. You can do nslookup requests over tcp like this:

nslookup "-set vc" yahoo.com

Of course, that won't help you with other traffic. For that I think you need a local dns forwarder.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy