How to Configure DNS Suffix Search Lists in Windows 11 Using PowerShell

In enterprise corporate environments, hybrid cloud setups, and multi-domain development labs, engineers frequently access internal servers using short, single-label hostnames—such as ping fileserver, ssh db-node, or connecting to an internal intranet portal. Because public DNS resolvers cannot parse unqualified single-label names without a Top-Level Domain (TLD), the Windows DNS client resolver must append domain extensions to the query.

The sequence and priority of domain extensions applied to unqualified queries is governed by the DNS Suffix Search List. If this search list is unconfigured or misordered, internal hostname queries can experience multi-second latency timeouts, fail to resolve across VPN tunnels, or erroneously resolve to unintended servers. Using the native PowerShell DnsClient module in Windows 11, administrators can configure global suffix search orders, manage primary domain devolution, and standardize name resolution across workstations. In this guide, we walk through how to audit existing suffix settings, deploy custom search lists via PowerShell, and troubleshoot hostname resolution.

How Windows 11 Resolves Unqualified Hostnames

When you query a short hostname (e.g., intranet), the Windows 11 DNS resolver evaluates suffixes in a strict hierarchical order:

1. Primary DNS Suffix: The computer’s primary domain name configured in system properties (e.g., corp.example.com).
2. Connection-Specific DNS Suffix: Suffixes supplied dynamically by DHCP or configured on the active network adapter (e.g., wifi.branch.example.com).
3. DNS Suffix Search List: A globally defined explicit array of domain suffixes configured by an administrator. When defined, the global search list takes absolute precedence, overriding adapter-specific suffixes.
4. Primary Domain Devolution: If enabled, Windows strips subdomains from right to left (for example, attempting intranet.corp.example.com, followed by intranet.example.com).

Step 1: Inspecting Current Global DNS Suffix Settings

To inspect your current global DNS resolution configuration, open an elevated PowerShell prompt:

1. Right-click the Start button on the taskbar and select Terminal (Admin) or PowerShell (Admin).
2. Execute the Get-DnsClientGlobalSetting cmdlet:

   Get-DnsClientGlobalSetting

PowerShell will return the active resolution parameters:

UseDevolution               : True
DevolutionLevel             : 0
SuffixSearchList            : {}
SendAllAddressesToDhcp      : False
UseParentSuffixSearchList   : False

If SuffixSearchList is empty {}, Windows relies entirely on adapter-level DHCP suffixes and primary domain settings.

Step 2: Checking Adapter-Specific Connection Suffixes

To check the connection-specific suffixes currently bound to individual physical or virtual network adapters:

Get-DnsClient | Select-Object InterfaceAlias, ConnectionSpecificSuffix, RegisterThisConnectionsAddress

Step 3: Configuring the Global DNS Suffix Search List

To establish an explicit, standardized DNS suffix search order, use the Set-DnsClientGlobalSetting cmdlet with the -SuffixSearchList parameter. Provide domain names in exact priority order within an array.

For example, to configure a priority search list checking corp.contoso.com first, followed by dev.contoso.com, and finally cloud.local:

Set-DnsClientGlobalSetting -SuffixSearchList @("corp.contoso.com", "dev.contoso.com", "cloud.local")

Confirm that the new search list is actively populated in the kernel resolver:

(Get-DnsClientGlobalSetting).SuffixSearchList

PowerShell will output each domain suffix on a separate line in priority order. This configuration applies immediately system-wide across all network interfaces without requiring a computer restart.

Step 4: Configuring Primary Domain Devolution

Domain devolution is an algorithmic feature where Windows automatically strips leftmost domain labels when resolving unqualified queries. For instance, if your machine belongs to us.west.corp.contoso.com, devolution will sequentially try:

1. host.us.west.corp.contoso.com
2. host.west.corp.contoso.com
3. host.corp.contoso.com

To control how many domain labels remain intact before devolution stops, set the DevolutionLevel. Setting a level of 2 ensures devolution never strips beyond the root second-level domain (preventing queries from leaking into public TLDs like .com):

Set-DnsClientGlobalSetting -UseDevolution $true -DevolutionLevel 2

Step 5: Setting Connection-Specific Suffixes on Adapters

If you prefer configuring a domain suffix exclusively for a specific connection (such as an office Ethernet link or a dedicated VPN tunnel) rather than imposing it globally:

Set-DnsClient -InterfaceAlias "Ethernet" -ConnectionSpecificSuffix "lab.contoso.com" -RegisterThisConnectionsAddress $true

Testing and Validating Suffix Resolution

To confirm that unqualified queries correctly expand through your newly defined suffix list:

1. Flush the local DNS client cache to clear stale failed records:

   Clear-DnsClientCache

2. Use Resolve-DnsName to test an unqualified hostname:

   Resolve-DnsName -Name "db-cluster" -DnsOnly

3. The Name field in the output will show the fully qualified domain name (FQDN) that responded (e.g., db-cluster.corp.contoso.com), confirming that Windows sequentially appended your search list.

Resetting to Factory Default Search Settings

If you need to remove custom global suffix lists and return DNS search behavior to automatic DHCP control, pass an empty array to the cmdlet:

Set-DnsClientGlobalSetting -SuffixSearchList @()

After clearing the list, verify with Get-DnsClientGlobalSetting that SuffixSearchList is once again blank.