2

How do i determine what is the "active" dns servers in defacto use?

If I do nslookup windows actively connects to (a) specific dns-server(s).

My guess is that it is the nameserver(s) configured for the network interface with the current default gateway but that is a pretty vague way to put it.

What if I have several network interfaces configured, all up, all with different nameservers configured. How do windows determine which dns servers to query?

Improve this question

3 Answers 3

Reset to default
6

It is determined by your binding order, which is set here:

Control Panel>Network and Internet>Network Connections>Advanced>Advanced Settings

The DNS servers it uses will be from the highest connection in the binding order, and go down the list from there.

You can test this, but I have had to change this on numerous occasions to put the [Remote Access Connections] to the top so a Microsoft PPTP VPN would use the domain controller's DNS to resolve to the domain's internal DNS server.

enter image description here

Improve this answer
5
  • I totally forgot about the binding order. . .
    – surfasb
    Jul 24, 2011 at 15:34
  • Ok, that makes sense. The routing table is used first, then the binding order is used if the metrics are the same. technet.microsoft.com/en-us/library/cc779696(WS.10).aspx
    – surfasb
    Jul 24, 2011 at 15:48
  • @surfasb Actually the routing table has nothing to do with what DNS server it chooses, only the binding order, and then it goes in order. If you are talking actual traffic, and two interfaces can get to the same IP, like having both LAN and Wireless connections to the Internet, it should go by metric. If the metrics are the same or automatic, it SHOULD choose the faster interface. See my recent answer here, where I quote the help file regarding this: superuser.com/questions/313679/…
    – KCotreau
    Jul 24, 2011 at 16:27
  • Ah true! No point using the table if you don't know the IP address. Initially, my understanding was the resolver queries all the adapters at once. But sometimes, that isn't always the case. It only queries all the adapters if the first query gets no answer.
    – surfasb
    Jul 24, 2011 at 20:08
  • @surfasb Right, it will go in binding order: First adapter, primary and secondary DNS; Second adapter, primary and secondary; and so on. As I mentioned in my answer, this might help you if you ever have to set up a VPN to a domain. Moving the [Remote Access Connections] to the top will make it use the domain's DNS servers, and resolve internal servers, etc. Otherwise, you could be trying to resolve 192.168.x.x-type addresses using a public DNS server, and fail of course. This could potentially drive someone crazy if they did not know what to look for.
    – KCotreau
    Jul 24, 2011 at 21:08
1

If you have multiple interfaces with multiple DNS servers, then you aren't asking which dns server you will use. Technically, you are asking which interface you will use. That is determined by your routing table.

Reading the routing table is the key to learning how Windows, or any operating system, chooses an interface.

http://technet.microsoft.com/en-us/library/cc779122(WS.10).aspx

sample routing table

If you are familiar with TCP/IP, then reading the routing table is easy. If not, I'd suggest you hit up google. Basically, you take the Network Destination and subnet mask and walk down the list til you get your first match. Then send the packet on through.

Which DNS server Windows will use is determined by several things. But to keep things simple, it will always use the primary DNS server listed on the interface. Then it will go down the list.

http://technet.microsoft.com/en-us/library/bb726983.aspx

Improve this answer
3
  • 1
    Isn't there's a catch-22 problem with this explanation? If I type nslookup www.example.com the operating system doesn't know which interface to use until it has decided which DNS server to use. It doesn't know which DNS server to use until it has decided which interface to use. I assume it would use the preferred name-server associated with interface associated with the default route, but this might not always be the right choice.
    – RedGrittyBrick
    Jul 24, 2011 at 10:17
  • Hey @surfasb You might want to see my answer to this question. Since I think you are an admin, it may help you in the future.
    – KCotreau
    Jul 24, 2011 at 11:41
  • @RedGrittyBrick: Hardly. DNS resolution is generally resolved in the following order: HOST file, ARP, NETBIOS, DNS. Look at your first route on the routing table. That will be your first DNS server in this case.
    – surfasb
    Jul 24, 2011 at 15:50
0

I believe the answer may depend on the version of Windows.

You can configure a list of DNS name-servers for each network connection shown in Control-Panel/Network-Connections.

DNS config dialog

You can see from the above that, for statically configured name-servers, one DNS name-server is considered the preferred one and the other an alternate. From this we can infer that the preferred name-server will normally be used for all queries, only if the primary is unavailable would the secondary be used.

We could assume that a list of DNS-servers provided dynamically (e.g. by a DHCP server) would be treated in a similar manner.

It is possible that the operating system might mark a name-server as down if it persistently fails to respond. Otherwise it must regard all of them as active - assuming the corresponding network interface is active ("up").

If you want an empirical answer, use something like wireshark to capture just DNS traffic and to produce some statistics about servers used.

Improve this answer
2
  • The way Windows handles the TCP IP protocol hasn't changed since the first version of NT. . .
    – surfasb
    Jul 24, 2011 at 9:35
  • If you have multiple interfaces all with different DNS server though, the order Windows uses them is by the binding order of the interfaces.
    – KCotreau
    Jul 24, 2011 at 11:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .