Enterprise DNS: troubleshoot intermittent name resolution

Measure intermittent DNS before changing it

When an application works one minute and fails the next, clearing cache often destroys evidence. Compare the same name from the same client against every resolver while retaining time, latency, response code, and answer.

This guide targets Windows 11 and Windows Server 2016 through 2025. Commands are read-only unless labelled as changes. Example domains and addresses are fictional.

1. Define the exact symptom

A connection failure after a correct DNS answer is not a DNS outage. Test the destination and application port separately.

• Short name or FQDN; A, AAAA, CNAME, SRV, or PTR.
• Affected client, subnet, VPN, or site; time and frequency.
• NXDOMAIN, SERVFAIL, timeout, wrong address, or application failure after a valid answer.
• Internal, external, or split DNS; resolver actually queried.

2. Record client configuration

Start with resolvers configured on the interface and connectivity to them. Include virtual adapters, VPNs, and search suffixes; multiple interfaces can explain different results.

In Active Directory, members normally use internal DNS able to resolve AD zones. Do not replace internal DNS with a public resolver as a fix.

Get-DnsClientServerAddress -AddressFamily IPv4 |
  Where-Object ServerAddresses |
  Format-Table InterfaceAlias, InterfaceIndex, ServerAddresses -Auto

Get-NetIPConfiguration |
  Select-Object InterfaceAlias, InterfaceIndex, NetProfile,
    @{n='IPv4';e={$_.IPv4Address.IPAddress}}

• Microsoft: troubleshoot DNS clients ↗
• Microsoft: DNS client configuration practices ↗

3. Query every server directly and repeatedly

Resolve-DnsName selects the server. -DnsOnly avoids LLMNR and NetBIOS; -NoHostsFile excludes hosts. Compare the same query and retain failures.

192.0.2.0/24 is reserved for examples. Replace these addresses with authorized DNS. One slow answer is not a diagnosis; correlate by resolver, site, record type, and time.

$Name = 'app.example.internal'
$Servers = '192.0.2.10','192.0.2.11' # fictional TEST-NET
foreach ($Server in $Servers) {
  1..10 | ForEach-Object {
    $sw = [Diagnostics.Stopwatch]::StartNew()
    try {
      $r = Resolve-DnsName -Name $Name -Server $Server -Type A -DnsOnly -NoHostsFile -ErrorAction Stop
      [pscustomobject]@{ Time=Get-Date; Server=$Server; Ms=$sw.ElapsedMilliseconds; Status='OK'; Answer=($r.IPAddress -join ',') }
    } catch {
      [pscustomobject]@{ Time=Get-Date; Server=$Server; Ms=$sw.ElapsedMilliseconds; Status='FAIL'; Answer=$_.Exception.Message }
    }
    Start-Sleep -Seconds 2
  }
}

4. Compare cache, TTL, and answer

Cache can retain an old address. A low TTL increases query volume; a high TTL prolongs bad data. Negative answers may also be cached.

Clearing cache changes state and destroys evidence. Capture entries first. Improvement after clearing points to cache or TTL but does not prove root cause.

Get-DnsClientCache |
  Where-Object Entry -eq 'app.example.internal' |
  Format-List Entry, RecordName, RecordType, Data, TimeToLive, Status

# CHANGE: clears the whole client cache after evidence is saved.
# Clear-DnsClientCache

• Microsoft: Get-DnsClientCache ↗

5. Separate internal zones, forwarders, and Internet

For internal names, query servers hosting the zone and compare replicated data. For Internet names, compare the internal resolver and forwarders. In split DNS, different answers may be intentional.

NXDOMAIN means the name does not exist in that view. SERVFAIL means the resolver could not answer: inspect forwarders, DNSSEC, delegations, and network access. Timeouts may originate at the server, network, or firewall.

6. Inspect the server without changing it

The DnsServer module comes with the role or RSAT and needs sufficient read rights. Record zones and forwarders before forming a hypothesis.

A conditional forwarder may be missing on one resolver. Compare masters, replication scope, and reachability without changing timeouts or root hints during collection.

# Authorized Windows DNS server; read-only.
Get-DnsServerZone | Select-Object ZoneName, ZoneType, IsDsIntegrated
Get-DnsServerForwarder | Select-Object IPAddress, Timeout, UseRootHint
Get-DnsServerConditionalForwarderZone |
  Select-Object Name, MasterServers, ReplicationScope

• Microsoft: DnsServer module ↗

7. Check records, delegations, and replication

Compare identical data on every authoritative server: A/AAAA, CNAME, SRV, PTR, TTL, and timestamp. Scavenging, delayed dynamic update, or conflicting records can vary results.

For AD-integrated zones, a DNS symptom may originate in AD replication. Use existing health tools; do not force broad replication as the first action.

$Zone = 'example.internal'
Get-DnsServerResourceRecord -ZoneName $Zone -Name 'app' |
  Select-Object HostName, RecordType, Timestamp, TimeToLive, RecordData
Get-DnsServerZoneDelegation -Name $Zone

8. Capture the failure with minimal scope

DNS Server Audit and Analytical logs can expose client, question, answer, and code. The Analytical log is hidden by default; enabling it adds telemetry. Pilot it, size retention, and restore prior state after collection.

Pktmon is built into recent Windows releases. This capture is a temporary change requiring an elevated shell. DNS names may be sensitive; restrict duration, access, and retention. Port 53 filtering may not see DNS over HTTPS.

# CHANGE: elevated shell; brief incident window only.
pktmon filter remove
pktmon filter add DNS-UDP -p 53
pktmon start --capture --pkt-size 0 --file-name C:\Temp\dns.etl
# Reproduce briefly, then:
pktmon stop
pktmon etl2pcap C:\Temp\dns.etl --out C:\Temp\dns.pcapng

• Microsoft: DNS logging ↗
• Microsoft: Pktmon ↗

9. Interpret without jumping to conclusions

10. Remediate with a pilot and rollback

Define the smallest correction: repair one forwarder, record, delegation, or replication path. Export relevant configuration and record prior values.

Pilot on one server or controlled scope. Validate internal/external names, AD SRV, VPN, and critical applications for at least the relevant TTL. Rollback restores documented prior configuration.

Avoid broad actions: mass cache clearing, universal TTL reduction, adding public DNS, or restarting every resolver together.

Reusable checklist

Infrastructure analysis can connect this evidence to Active Directory dependencies, network sites, and critical applications without replacing a full assessment.

• Time, client, network, name, and type are recorded.
• Every resolver is queried directly and repeatedly.
• Cache, split DNS, forwarders, and authorities are separated.
• Data is compared across servers.
• Capture is brief, protected, and deleted under policy.
• Pilot, application tests, and rollback are documented.