guidox / PC
Add an entry with **Add-DnsClientNrptRule -Namespace .corp.example.com -NameServers 10.0.0.10**, then check with **Get-DnsClientNrptRule** and verify with **Resolve-DnsName**.
One name resolves with a public resolver and another does not. Testing both explicitly proves the problem is routing, not connectivity.
Resolve-DnsName -Name intranet.corp.example.com -Server 1.1.1.1 -ErrorAction SilentlyContinue
Resolve-DnsName -Name intranet.corp.example.com -Server 10.0.0.10 -ErrorAction SilentlyContinue
Get-DnsClientServerAddress -AddressFamily IPv4 | Select-Object InterfaceAlias,ServerAddressesThe NRPT is a list of rules with a namespace, a server list and flags. An existing rule for the same suffix wins over a new one.
Get-DnsClientNrptRule | Select-Object Name,Namespace,NameServers,DisplayName,Version
Get-DnsClientNrptGlobal | Select-Object EnableDAForAllNetworks,QueryPolicy
Get-DnsClientNrptPolicy -ErrorAction SilentlyContinue | Select-Object Namespace,NameServersThe namespace starts with a dot to match the suffix and every name below it. **-NameEncoding** and **-DnsSecValidation** can stay at their defaults for an internal zone.
Add-DnsClientNrptRule -Namespace '.corp.example.com' -NameServers '10.0.0.10','10.0.0.11' -DisplayName 'Corp zone'
Get-DnsClientNrptRule | Select-Object Namespace,NameServers,DisplayName
Get-DnsClientNrptRule -DisplayName 'Corp zone' | Format-ListThe cache keeps the old negative answer. Flushing and re-resolving is the confirmation that the new route is used.
Clear-DnsClientCache
Resolve-DnsName -Name intranet.corp.example.com -ErrorAction SilentlyContinue
Resolve-DnsName -Name other.corp.example.com -ErrorAction SilentlyContinue
Resolve-DnsName -Name example.com -ErrorAction SilentlyContinueA rule that depends on the current adapter breaks on a different network. The NRPT is machine-wide by default, which is what makes it work at home and in the office.
Get-DnsClientNrptRule | Select-Object Namespace,NameServers,@{n='PerInterface';e={$_.NameServers.Count}}
Get-NetConnectionProfile | Select-Object Name,NetworkCategory,InterfaceAlias
Get-DnsClientNrptRule -DisplayName 'Corp zone' | Select-Object -ExpandProperty NameServersIf the listed server is unreachable, resolution for that zone fails instead of falling back to the public resolver. That is intentional, and worth knowing before you travel.
Test-NetConnection -ComputerName 10.0.0.10 -Port 53
Get-DnsClientNrptRule | Select-Object Namespace,NameServers,Comment
Resolve-DnsName -Name intranet.corp.example.com -ErrorAction SilentlyContinue | Select-Object Name,Type,IPAddressThe namespace needs the leading dot, and an existing broader rule may match first. List all rules and remove the conflicting one.
The listed server is unreachable. Test port 53 to it and correct the address.
The PowerShell cmdlet uses the client stack but caches per process. Clear the cache and try a fresh shell.
A policy or a VPN client rewrites the table. Check the policy keys under the DNS client and the VPN's own configuration.
No. A hosts entry maps one name to one address; the NRPT sends the whole zone to a server, which keeps records and changes working.
The rule can carry DoH settings on newer builds. For an internal server, plain DNS over the LAN is the usual choice.
Yes, with the per-interface options in the rule. The default machine-wide scope is simpler and usually correct.
Remove the rule with Remove-DnsClientNrptRule -DisplayName 'Corp zone' -Force, then run Clear-DnsClientCache.
Free · no account needed · tracks your progress