DNS not resolving in Windows 11 — websites not loading despite being connected to the internet, “DNS_PROBE_FINISHED_NXDOMAIN” errors in Chrome, or “Server not found” in other browsers — means Windows can’t translate domain names like google.com into IP addresses. The fix is usually quick. We go deeper on the whole subject in our Complete Guide to Fixing Windows, Browser, and Software Errors.
Immediate test to confirm DNS is the issue: open Command Prompt → type ping 8.8.8.8. If you get replies: the internet connection works at the IP level, but DNS isn’t working. If ping also fails: the problem is broader than DNS — check basic connectivity first. This single command separates DNS failures from full connectivity failures and determines where to focus.
The fastest fix: flush DNS and reset
A corrupted DNS cache causes failed lookups even when the DNS server is reachable. Administrator Command Prompt, run these in sequence:
ipconfig /flushdns
ipconfig /registerdns
ipconfig /release
ipconfig /renew
netsh winsock reset
Restart after running these. The flush clears stale or corrupted cache entries; the Winsock reset fixes lower-level network socket issues that can affect DNS. This sequence resolves most sudden-onset DNS failures in under 2 minutes.
DNS server configuration
If flushing didn’t help: the DNS server itself may be unreachable or returning wrong answers. Manually setting a reliable DNS server bypasses your ISP’s DNS or router DNS entirely:
Settings → Network and internet → your connection → DNS server assignment → Manual → enter:
- Google: 8.8.8.8 and 8.8.4.4
- Cloudflare: 1.1.1.1 and 1.0.0.1
- Quad9: 9.9.9.9 and 149.112.112.112
Any of these alternatives work. If DNS resolves after switching: your router’s DNS or ISP’s DNS was the problem. Leave a reliable public DNS configured permanently for better reliability and often faster lookup times.
DNS Client service
The DNS Client service handles DNS caching and query forwarding in Windows. If this service stops or crashes: all DNS resolution fails. Services.msc → “DNS Client” → if the status isn’t “Running”: right-click → Start. If it shows an error or can’t be started: run SFC to repair the service’s binary:
sfc /scannowAdministrator Command Prompt. Restart after SFC completes. A corrupted DNS Client service binary causes persistent DNS failure that the flush commands above won’t resolve.
Router and ISP DNS failures
If DNS fails on all devices on the same network simultaneously: it’s the router or ISP, not Windows. Reboot the router (power off, wait 30 seconds, power on) → test DNS on multiple devices. If DNS works after the router reboot: the router’s DNS cache was corrupted. Permanently fixing router DNS: access the router admin → DNS settings → enter 8.8.8.8 and 1.1.1.1 as the upstream DNS servers → save → this means all devices on the network use reliable DNS without needing per-device configuration.
VPN and DNS leakage
VPN connections sometimes push their own DNS servers and block access to others. When you disconnect: Windows doesn’t always restore the original DNS configuration immediately, leaving a period where DNS doesn’t resolve because the VPN’s DNS server is unreachable but still configured.
After disconnecting a VPN and experiencing DNS failure: ipconfig /flushdns → if still failing, set DNS to automatic (DHCP) in network settings → reconnect to the network. For VPNs that consistently leave broken DNS after disconnection: the VPN software’s DNS cleanup routine is faulty — check for updates or switch to a more reliable VPN client.
Specific domains not resolving
If most websites work but specific ones don’t resolve: check the Windows hosts file. C:WindowsSystem32driversetchosts — open with Notepad (run as administrator). If the failing domain appears in this file with a redirect (e.g., 0.0.0.0 example.com): it’s been blocked at the hosts file level. This is sometimes done by parental control software, ad blockers that use hosts file blocking, or malware. Remove the entry to restore access.
Our guide on DNS server errors covers the router-side DNS configuration that affects all devices on a network. For VPN-related DNS issues that affect Windows networking more broadly, our VPN troubleshooting guide covers DNS leak prevention and post-disconnect cleanup. Microsoft’s DNS troubleshooting documentation covers the DNS Client service architecture, the DNS cache contents (viewable with ipconfig /displaydns), and the Windows DNS resolver configuration including DoH (DNS over HTTPS) support in Windows 11.
DNS over HTTPS (DoH) in Windows 11
Windows 11 supports encrypted DNS queries through DNS over HTTPS, which prevents ISPs and network intermediaries from seeing which domains you’re looking up. Settings → Network and internet → your connection → DNS server assignment → Manual → enter a DoH-capable server like Cloudflare (1.1.1.1) → set “DNS over HTTPS” to “On (automatic template)” or enter the DoH URL manually (for Cloudflare: https://cloudflare-dns.com/dns-query).
DoH can occasionally cause DNS resolution failures on networks that block HTTPS DNS queries (some corporate networks, some ISPs). If DNS fails after enabling DoH: set it back to “Off” → test. If DNS works with DoH off: your network is blocking DoH traffic, and unencrypted DNS is the only option in that environment.
nslookup for diagnosing DNS problems
The nslookup command is the essential DNS diagnostic tool. Command Prompt:
# Test DNS resolution against your default server
nslookup google.com
# Test against a specific DNS server
nslookup google.com 8.8.8.8
# Test against Cloudflare
nslookup google.com 1.1.1.1
If nslookup google.com fails but nslookup google.com 8.8.8.8 succeeds: your default DNS server is broken but 8.8.8.8 works — change your DNS settings to use 8.8.8.8 as above. If both fail: the network connection itself has a problem beyond DNS. If your default server resolves google.com but specific domains fail: those specific domains have issues (NXDOMAIN = doesn’t exist, SERVFAIL = server error at the domain’s DNS).
Network adapter driver and DNS
A faulty network adapter driver can cause DNS queries to be sent but not received correctly — the DNS request goes out but the response packets get dropped or corrupted at the driver level. This produces DNS failures that persist even when the DNS server is correct and reachable. Symptoms: nslookup with a specific server times out even though pinging that server’s IP works. Fix: update the network adapter driver from the manufacturer’s page — not Windows Update’s generic version.
Windows Firewall and DNS
DNS uses UDP port 53 (and TCP port 53 for larger responses). Windows Firewall usually allows DNS by default, but third-party firewalls or overly restrictive firewall rules can block UDP 53 outbound, preventing DNS queries from reaching the server. Test: temporarily disable any third-party firewall → try DNS resolution. If DNS works with the firewall disabled: a firewall rule is blocking DNS. Allow outbound UDP/TCP port 53 as an exception in the firewall settings.
IPv6 and DNS failures
Windows 11 prefers IPv6 when available. DNS has both IPv4 (A records) and IPv6 (AAAA records) resolution paths. If the IPv6 DNS configuration is broken while IPv4 DNS works: some lookups succeed and others fail depending on which path is used. Test: Settings → Network and internet → your connection → DNS server assignment → set both IPv4 and IPv6 DNS explicitly, or disable IPv6 (Settings → advanced network settings → your adapter → uncheck “Internet Protocol Version 6”) to use only IPv4 DNS while troubleshooting.
Malware redirecting DNS
Some malware modifies DNS settings to redirect traffic through malicious DNS servers that return wrong addresses for banking, social media, or security sites. Signs: specific trusted sites show warning messages or redirect to unexpected pages, while other sites work fine. The DNS server configured on your adapter isn’t what you set (check Settings → Network → DNS configuration). Run Windows Security full scan and Malwarebytes before making DNS changes — correcting DNS settings without removing the malware means the malware can re-change them.
| Symptom | Likely cause | Fix |
| All sites fail, ping by IP works | DNS server unreachable or cache corrupted | Flush DNS; set public DNS (8.8.8.8 or 1.1.1.1) |
| All devices on network affected | Router or ISP DNS failure | Reboot router; set upstream DNS to 8.8.8.8 |
| Fails after VPN disconnect | VPN left broken DNS configuration | Flush DNS; reset to DHCP; reconnect network |
| Specific domains only failing | Hosts file block or NXDOMAIN | Check hosts file; domain may not exist |
| DNS resolves but returns wrong IP | Malware modifying DNS | Run security scan; reset DNS server to known-good |
DNS failures feel dramatic because they break internet access almost completely — but they’re among the most reliably fixable networking problems. The flush-and-reset command sequence plus a DNS server change to a public resolver resolve the vast majority of cases within 5 minutes. The nslookup diagnostic pinpoints exactly which part of the DNS chain is broken when those quick fixes don’t immediately help.
For small home networks where DNS reliability matters: configuring the router to use 1.1.1.1 (Cloudflare) and 8.8.8.8 (Google) as upstream DNS servers, rather than the ISP’s default, provides noticeably faster DNS responses and better reliability than most ISP-provided DNS servers. This single router configuration change improves DNS performance for every device on the network. Cloudflare’s 1.1.1.1 is consistently ranked as one of the fastest DNS resolvers globally — a router configuration change that takes 2 minutes and improves DNS performance for everyone in the household.
DNS caching and TTL
DNS responses include a TTL (Time to Live) value that tells Windows how long to cache the answer before querying again. Common TTLs: 300 seconds (5 minutes) for many services, 3600 seconds (1 hour) for stable domains, 60 seconds for services that change frequently. When a site moves to a new IP: the old cached IP might be served until the TTL expires. Flushing the DNS cache (ipconfig /flushdns) forces Windows to fetch fresh answers immediately rather than waiting for TTL expiry. This is why the flush command is often the fastest fix for suddenly-broken specific sites — it clears an incorrect cached entry and allows the correct current IP to be fetched.
Testing DNS resolution speed
DNS response time affects how quickly every page starts loading — even on a fast internet connection, slow DNS adds perceptible delay. Test your current DNS speed: install Namebench (free, from Google) or use online DNS benchmarking tools → run a benchmark → it tests multiple DNS servers from your location and recommends the fastest options. The “fastest” DNS server varies by geographic location and ISP network topology; a server that’s fastest in one region may not be fastest elsewhere. Running a local benchmark rather than using globally-recommended servers provides the most accurate recommendation for your specific network.
Private DNS (Android-style) in Windows 11
Windows 11’s DoH support essentially provides what Android calls “Private DNS” — encrypted DNS queries that prevent snooping. Combining DoH with a reputable DNS provider (Cloudflare, Quad9 which adds malware filtering, or NextDNS which allows custom filtering rules) provides both privacy and optional content filtering. NextDNS in particular allows detailed logging of DNS queries, blocking lists for ads and trackers at the DNS level (affecting all devices if configured at the router), and custom rules — a comprehensive DNS management solution that goes well beyond just fixing DNS failures.
A useful troubleshooting habit for intermittent DNS issues: run ipconfig /displaydns in Command Prompt to see the current DNS cache contents. This shows every domain name Windows has recently resolved and cached, including the TTL remaining and the IP it resolved to. Spotting a domain in the cache with an obviously wrong IP (like a loopback address 127.0.0.1, a bogon address, or an unexpected IP for a trusted domain) immediately identifies a specific corrupted entry that ipconfig /flushdns clears. For intermittent failures that clear after a browser restart: the browser’s own DNS cache (separate from Windows’) may be the source — Chrome: chrome://net-internals/#dns → Clear host cache; Edge: edge://net-internals/#dns → Clear host cache.
Hosts file for custom DNS overrides
The Windows hosts file (C:WindowsSystem32driversetchosts) provides local DNS overrides that take priority over any DNS server. This is how ad blockers, parental control software, and certain security tools implement domain blocking. It’s also useful legitimately: developers use hosts file entries to point a domain to a local development server for testing. If you’ve added hosts file entries for development and they’re interfering with accessing live sites: review the file and remove or comment out (add # at line start) entries that are no longer needed. The hosts file should be minimal for production use — only entries you actively need and understand.
DNS troubleshooting follows a straightforward diagnostic tree: ping by IP (confirm connectivity) → nslookup with current DNS then with 8.8.8.8 (isolate whether the server or the configuration is wrong) → flush and reset (clear cache and socket state) → change DNS server (if server itself is the problem). Each step answers one question, and the answers point directly to the next action. This methodical approach resolves DNS failures in a predictable sequence without guesswork, and the entire diagnostic sequence from first command to working DNS takes under 10 minutes in typical cases. You might also run into VPN Slowing Internet Speed.
