Windows 10 VPN is not using DNS suffix in lookups

dnsvpnwindows

Our VPN is configured to send the domain-name-server and domain-search parameters from our DHCP server to connected clients.

However, we've been experiencing issues with the domain name resolution – specifically, the domain-search suffix(es) is not being added to the hostname when using software like MSTSC or even nslookup. They are at least looking on the right DNS server, though, and the FQDN is resolved correctly – it's just when I try hostname lookups that it isn't appending the suffix.

What is odd is that a ping for any-hostname will get a response from any-hostname.domain.

I know that ping implements its own resolver separate from nslookup (and other software) – but don't understand how it can know about the DNS suffix when the other software doesn't.

Also, when I check the connection configuration with ipconfig – the correct DNS suffix is listed under the PPP connection – so I know that it's being sent from DHCP over the VPN.

Any suggestions?

Best Answer

I believe lan connection of the client has a higher priority/metric than the local one. That is normal. It depends on the name resolution order. Did you check the TCP/IP settings (Advanced settings) in the client? Check the metric of the gateway, DNS settings (DNS tab), and the name resolution order and there are other services too. IP/v6 also provides techniques.

Most importantly, there is a specific setting known as the VPN Binding Order. Imo, this could be the issue.

You could try the solution below. This is copied directly from this Microsoft article.

  1. Click Start, type regedit32 in the Open box, and then click OK.
  2. Click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage
  3. In the right pane, double-click Bind.
  4. In the Value data box, select the "\Device\NdisWanIp" item, press CTRL+X, click the top of the list of devices, and then press CTRL+V.
  5. Click OK, and then quit Registry Editor.
  6. Restart the remote system.

Note: If you use an AD enabled network, you may be able to use a policy.

Related Question