What can I do to trace the origin of a DNS resolution in Windows 7?

Question

How do I trace the origin of a DNS resolution in Windows 7?

Hosts involved:

• Windows 7 host WIN7 where I'm trying to remove the name-to-IP mapping
• home router running a DHCP service
• host ABC renamed to DEF

On a Windows 7 host, I had a name ABC mapped to an IP number via C:\Windows\System32\drivers\etc\hosts. I removed the mapping from the HOSTS file. I renamed the Linux computer ABC to DEF and had it re-register with the DHCP server running on the router station (a Synology product) using its new name. (Just in case the DHCP server on the router would use DHCP leases to also offer some name resolution services.)

I issued a ipconfig /flushdns on the Windows 7 host from an elevated command prompt. I even stopped the DNS cache using net stop dnscache.

[Update:] An nslookup abc returns Non-existent domain. The host DNS queries are relayed to is the router I mentioned above. [/Update]

And yet, a ping abc still resolves the bloody name to the wrong IP number, to the one I had removed the mapping for. What can I do to trace this issue to its root?

[Update 2:] I rebooted: the issue persists. I unplugged the Win7 host from the network. (Well, switched off WLAN.) The system still resolved abc to IP number 192.168.33.102, directly subsequent to an ipconfig /flushdns executed as Administrator. Which leads me to conclude that there is some local system cache that remains unaffected by ipconfig /flushdns. [/Update 2]

A related question (but confined to the cache flush issue, and just flushing doesn't solve the problem for me): How do I update / flush / reset my DNS records in Windows?

Solution 1

It's probably the NetBIOS name cache. Try purging it using nbtstat from an elevated command line window:

nbtstat -R

You might also wish to disable NetBIOS. This option is available on the WINS tab of the Advanced TCP/IP Settings dialog.

Solution 2

Running nslookup will show you the name resolution using responses of the current (normally the "primary") name server.

It's my normal first step when troubleshooting name resolution problems in Windows, especially when messing with HOSTS file entries and having to flush the dns cache.

Comments

[Oliver Salzburg]

In Windows 8/Server 2012 (or generally PowerShell 3.0), there seems to be the cmdlet Resolve-DNSname.

[banshee20]

Forget to mention that nslookup abc returns Non-existent domain. The host DNS queries are relayed to is the router I mentioned in my description. The common home setup, a router/gateway to the Internet.

[banshee20]

This is it. But in a way that is somewhat embarrassing to reveal. Almost a year ago, I tried to figure out the NetBIOS business but never really properly understood it. Not disposing of a WINS server, I discovered you could have a substitute in editing the LMHOSTS file, which lives right next to the HOSTS file. So that's what I did. And that's what the entry for abc came from. It was bound to hit me with a vengeance when I would have forgotten about my dabbling with NetBIOS. Thank you for pointing me there.