Clear, practical technology insights
TipsMake Learning
Explore TipsMake guides
Learning Library
IP, Gateway and DNSLesson 9 of 16

Understand DNS

DNS lets people use names such as example.com while applications connect to IP addresses. It is a distributed naming system, not the internet connection itself. A device can reach an external IP address while failing to open websites by name, which is strong evidence of a resolver or application problem. The reverse is also possible: a cached answer may exist even when the route is broken. This lesson uses nslookup and ordered tests to separate DNS from local Wi-Fi and upstream reachability.

12 min Beginner IP, Gateway and DNSReviewed 2026-07-30 00:00:00
Learning objectives

What you will learn

  • Explain DNS resolution without treating it as the whole internet.
  • Identify configured DNS servers.
  • Use nslookup to test a name and a specific resolver.
  • Avoid arbitrary DNS changes before recording evidence.
Before you start

What you need

  • A Windows device with Command Prompt.
  • A known domain approved for testing.

Separate naming from reachability

RFC 1034 describes DNS as a distributed system for mapping domain names and other data through name servers and resolvers.

Microsoft documents nslookup as a tool for diagnosing DNS infrastructure and displaying name-resolution information.

A browser first needs a DNS answer, then it opens a connection to an address. HTTPS certificates, proxies, VPNs, filtering and the remote service can still cause failure after DNS succeeds.

DNS resolution flow from a domain name through a resolver to an IP address and connection.
Name resolution produces an address; a separate network connection still has to reach that address.

Identify the configured resolver

Use ipconfig /all or Windows network properties to record the DNS server assigned to the active adapter. Home clients often use the router as a forwarding resolver, so the listed address may be the gateway rather than the provider's upstream server.

VPN software and managed-device policy can intentionally replace DNS settings. Do not overwrite them without authorization; doing so can break internal names, security filtering or split-tunnel behavior.

  1. 1

    Run ipconfig /all and locate DNS Servers under the active adapter.

  2. 2

    Run nslookup example.com and record the server, address and answer.

  3. 3

    Repeat with a second known domain.

  4. 4

    Compare the result with an external-IP connectivity test.

  5. 5

    Note whether a VPN, proxy or security product is active.

Read nslookup results carefully

A valid answer shows the resolver returned records; it does not guarantee the website is healthy. A timeout can mean the configured resolver is unreachable or not responding. NXDOMAIN means the resolver reports that the queried name does not exist, which may be correct for a typo.

Different answers are not automatically evidence of attack. Content delivery networks, geographic routing and load balancing can return multiple addresses. Compare timing, status and authoritative documentation rather than expecting one permanent IP.

Verification checklist
  • The DNS server address is known.
  • At least one approved name resolves consistently.
  • External IP reachability is tested separately.

Change DNS only as a controlled test

Flushing the local resolver cache removes cached answers; it does not change the DNS server. Changing the resolver is a separate configuration change and can affect privacy, filtering and access to internal services.

Before a temporary resolver comparison, record automatic settings and obtain permission. Restore DHCP-provided DNS after the test unless the network owner has approved a permanent service.

  1. 1

    Save the current adapter and DNS settings.

  2. 2

    Run ipconfig /flushdns only when stale cached results are plausible.

  3. 3

    Repeat nslookup and record whether the response changes.

  4. 4

    If authorized, test a specific resolver with nslookup name server-address without changing Windows settings.

  5. 5

    Restore original settings and verify internal and public names.

Hands-on practice

Diagnose a name-resolution scenario

Use separate IP and DNS tests to classify a failure.

  1. 1

    Record the configured DNS server.

  2. 2

    Test the gateway and an approved external IP.

  3. 3

    Run nslookup for two domains.

  4. 4

    Test one query against a specific authorized resolver.

  5. 5

    Write whether the evidence points to DNS, routing or the application.

Common mistakes to avoid

  • Calling every website failure a DNS problem.
  • Changing DNS before recording the assigned server.
  • Assuming one returned IP is permanent.
  • Ignoring VPN or managed-device DNS policy.
Lesson recap

Key takeaways

  • DNS maps names; routing reaches addresses.
  • nslookup tests resolver behavior separately.
  • A controlled comparison is safer than permanently replacing DNS.

Frequently asked questions

Does flushing DNS speed up the internet?

No. It removes cached resolver entries and is useful only when stale or incorrect cached data is suspected.

Why does nslookup show my router as the DNS server?

Many home routers accept client DNS queries and forward them to upstream resolvers.

Evidence and updates

Sources and further reading

  1. RFC 1034: Domain names — concepts and facilitiesRFC Editor
  2. nslookupMicrosoft Learn
  3. ipconfigMicrosoft Learn
Finish this lesson

Ready to continue?

Mark the lesson complete so your Learning Path progress stays current on this device.