2

Forget everything you've read about Windows hostname resolution, because it's wrong when it comes to LAN (unqualified) hostnames. No matter what I try, Windows will not contact the configured DNS server to resolve these. I've examined it in Wireshark, and Windows will use NetBIOS (UDP), mDNS, LLMNR, etc. but never, ever plain old port 53 DNS.

I've tried all the tricks: Disabling NetBIOS over TCP (irrelevant since it uses UDP by default anyway), telling my router's dnsmasq to advertise disabling of NetBIOS, appending . suffix to unqualified name resolution list, registry hacks to disable multicast name resolution, etc. All these accomplish is disabling one or more of NetBIOS, mDNS, LLMNR, etc. resolution for LAN hosts without enabling DNS.

The only thing that seems to work is manually appending a . to a hostname when entering it.

I get that this is probably some kind of security thing, but surely in 2021 most home routers now provide their own DNS service advertised via DHCP.

Am I missing something?

Edit: As a workaround, I've enabled Samba on my router, with DNS proxying and WINS enabled. This seems to create a bridge between DNS and NetBIOS.

Edit 2: After extensive research with Wireshark, Avahi, wsdd2, Samba, etc., I have determined that in addition to Windows 10 simply refusing to use regular DNS for unqualified hostnames, it will also wait for its LLMNR query to time out before completing unqualified hostname resolution - even if it has received both NetBIOS and mDNS responses. If it gets an LLMNR response (e.g. when pinging another Windows 10 machine, or a Linux machine running wsdd2 with LLMNR enabled), resolution completes instantly.

Edit 3: Confirmed - I followed instructions for disabling "multicast name resolution" in Windows 10, which actually disables mDNS and LLMNR while leaving NetBIOS enabled. Windows 10 now immediately accepts NetBIOS answers from my router's Samba server as authoritative. https://www.blackhillsinfosec.com/how-to-disable-llmnr-why-you-want-to/

6
  • What's the router make and model? Sadly no, some consumer rated gear is still just forwarding requests to the upstream isp router for resolution. Commented Apr 3, 2021 at 5:24
  • After pulling a large part of my hair out, I found an obscure setting in the registry to disable mDNS. I never had problems with the other name resolution technologies (or perhaps I did unknowingly ...). Unfortunately I don't remember that setting, but I found it on the internet, so I guess there is hope. My DNS server runs on a small Linux server. Commented Apr 3, 2021 at 5:52
  • @Tim_Stewart I've been exclusively using routers that support custom firmware like Tomato for almost two decades.
    – HunterZ
    Commented Apr 3, 2021 at 17:45
  • @berndbausch As I said in my question, I tried that registry hack, and it did indeed disable mDNS/NetBIOS/LLMNR broadcast queries, but it did not enable DNS ones!
    – HunterZ
    Commented Apr 3, 2021 at 17:45
  • Ditto. Have been using third party firmware since the wrt54gl. But, haven't experienced this with windows. I'm using pfsense as our main router/local dns resolution though. What version of Windows is doing this? Commented Apr 3, 2021 at 20:11

0

You must log in to answer this question.

Browse other questions tagged .