How to Configure DNS Client Negative Cache TTL in Windows 11 Using PowerShell

When Windows 11 performs a Domain Name System (DNS) query for a host that does not exist or fails to resolve, the DNS Client service (Dnscache) records a negative response known as an NXDOMAIN or negative cache entry. By default, Windows caches these failed lookup responses for up to 5 to 15 minutes (or whatever Time-To-Live was returned by the authoritative DNS server, up to a built-in maximum). While negative caching reduces redundant network queries to DNS servers, it frequently frustrates network administrators, software engineers, and DevOps specialists. If a new subdomain is provisioned or a DNS record is updated immediately after a failed query, Windows continues returning NXDOMAIN until the negative cache expires or is manually flushed. Using PowerShell, you can inspect and configure the MaxNegativeCacheTtl parameter to prevent persistent negative cache lockouts.

Understanding Windows DNS Negative Cache Behaviour

The Windows DNS Client service manages two distinct internal caching pools:

• Positive Cache: Stores successfully resolved records (A, AAAA, CNAME, PTR) for the duration specified by the record’s TTL, capped by MaxCacheTtl (defaulting to 86,400 seconds or 1 day).
• Negative Cache: Stores failed lookups and non-existent domain responses. The lifetime of negative records is capped by MaxNegativeCacheTtl. In modern Windows versions, the default cap is 5 seconds to 15 minutes depending on Windows edition and network profile settings.
• NetBT Negative Cache: Stores failed NetBIOS over TCP/IP name queries, governed separately by NetbtNegativeCacheTtl.

When negative caching is left unmanaged in dynamic development or staging environments, automated deployment scripts or browser sessions can become locked out of newly propagated records. By configuring MaxNegativeCacheTtl via PowerShell, you can clamp the maximum caching window down to a few seconds or disable negative caching entirely.

Auditing Active DNS Client Cache Entries Using PowerShell

Before modifying cache parameters, inspect the current entries stored inside the Windows DNS Client resolver cache using the Get-DnsClientCache cmdlet.

Get-DnsClientCache

To specifically filter for negative cache entries where resolution failed (indicated by a non-zero status or absence of record data), run:

Get-DnsClientCache | Where-Object { $_.Status -ne 0 } | Select-Object Entry, TimeToLive, Status, Type

If you need to clear the active cache immediately while testing, use Clear-DnsClientCache:

Clear-DnsClientCache

Configuring MaxNegativeCacheTtl via PowerShell

The DNS client negative cache TTL is defined in the Windows Registry under the Dnscache\Parameters key. To inspect whether a custom TTL override is already defined, execute:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" -Name "MaxNegativeCacheTtl" -ErrorAction SilentlyContinue

If the property does not exist, Windows applies its internal default limit. To configure a custom maximum negative cache TTL, use Set-ItemProperty or New-ItemProperty in an elevated PowerShell session.

For example, to set the negative cache duration to a maximum of 5 seconds (ensuring quick recovery when provisioning new resources):

$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters"
if (-not (Get-ItemProperty -Path $regPath -Name "MaxNegativeCacheTtl" -ErrorAction SilentlyContinue)) {
    New-ItemProperty -Path $regPath -Name "MaxNegativeCacheTtl" -Value 5 -PropertyType DWord -Force
} else {
    Set-ItemProperty -Path $regPath -Name "MaxNegativeCacheTtl" -Value 5 -Force
}

To completely disable negative DNS caching so failed queries are never cached locally, set the value to 0:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" -Name "MaxNegativeCacheTtl" -Value 0 -Force

Configuring NetBIOS Negative Cache TTL

If your local network relies on legacy NetBIOS or WINS name resolution alongside DNS, failed local machine lookups may also be held in the NetBT negative cache. To prevent NetBIOS negative lookups from stalling discovery, configure NetbtNegativeCacheTtl:

$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters"
if (-not (Get-ItemProperty -Path $regPath -Name "NetbtNegativeCacheTtl" -ErrorAction SilentlyContinue)) {
    New-ItemProperty -Path $regPath -Name "NetbtNegativeCacheTtl" -Value 0 -PropertyType DWord -Force
} else {
    Set-ItemProperty -Path $regPath -Name "NetbtNegativeCacheTtl" -Value 0 -Force
}

Restarting the DNS Client Service and Verifying Configuration

In Windows 11, the DNS Client service (Dnscache) is protected by the operating system and runs within a shared service host process. In many environments, running Restart-Service Dnscache directly will return an “Access Denied” error because of service isolation permissions.

To ensure your new registry parameters take full effect without requiring a full system reboot, flush the resolver cache and register DNS records:

Clear-DnsClientCache
Register-DnsClient

You can verify that the registry value is securely set by reading back the property:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" | Select-Object MaxNegativeCacheTtl, NetbtNegativeCacheTtl

Testing Negative Cache Expiry in Windows 11

To confirm that failed DNS lookups now expire according to your custom TTL:

1. Perform a lookup against a non-existent host using Resolve-DnsName:

   Resolve-DnsName -Name "nonexistent-test-domain-12345.local" -ErrorAction SilentlyContinue

2. Query the DNS cache immediately to check the remaining TTL:

   Get-DnsClientCache -Entry "nonexistent-test-domain-12345.local" | Select-Object Entry, TimeToLive, Status

3. Observe that the TimeToLive value starts at or below your configured MaxNegativeCacheTtl value and rapidly drops to zero, ensuring your resolver never remains locked to stale negative responses.