How to Configure Windows Sandbox Custom DNS Client Settings via XML in Windows 11

Windows Sandbox provides an isolated, ephemeral desktop container ideal for evaluating untrusted applications and testing web services. By default, Windows Sandbox inherits the host system’s virtual switch networking, resolving domain names through the internal Hyper-V NAT gateway. However, when debugging private internal networks, testing DNS sinkholes, or evaluating DNS-over-HTTPS (DoH) security endpoints, developers need the container to query specialized DNS resolvers directly. In Windows 11, combining .wsb XML configuration with automated PowerShell logon scripts allows you to configure custom DNS resolvers inside Windows Sandbox upon startup.

Understanding Sandbox Networking and Adapter Configuration

Windows Sandbox configures a virtual Ethernet adapter (typically named vEthernet (Internal Ethernet Port Windows Sandbox)) that receives DHCP assignments from the host Hyper-V NAT switch. While the native XML directive <Networking>Default</Networking> provides general Internet access, custom name server assignments must be applied to the virtual network adapter at boot via PowerShell.

Authoring the Automated DNS Configuration Script

Create a dedicated host folder (e.g. C:\SandboxDNSConfig) and save a configuration script named SetDnsResolvers.ps1:

# SetDnsResolvers.ps1 - Configure dedicated DNS resolvers inside Windows Sandbox
Write-Host "Configuring custom DNS client resolvers..." -ForegroundColor Cyan

# Locate the active primary network adapter
$adapter = Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -First 1

if ($adapter) {
    # Configure custom primary and secondary DNS resolvers (e.g. Cloudflare Security 1.1.1.2 / 1.0.0.2)
    $dnsServers = @("1.1.1.2", "1.0.0.2")
    Set-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex -ServerAddresses $dnsServers
    Write-Host "Configured DNS resolvers on $($adapter.Name): $($dnsServers -join ', ')" -ForegroundColor Green

    # Flush DNS resolver cache
    Clear-DnsClientCache
    Write-Host "Flushed local DNS resolver cache." -ForegroundColor Green
} else {
    Write-Warning "Active network adapter not found inside Sandbox."
}

Constructing the WSB Configuration File

Create an XML configuration file named CustomDnsSandbox.wsb on your host desktop:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxDNSConfig</HostFolder>
      <SandboxFolder>C:DNSConfig</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -NoExit -ExecutionPolicy Bypass -File C:DNSConfigSetDnsResolvers.ps1</Command>
  </LogonCommand>
</Configuration>

Verifying Custom DNS Resolution Inside the Sandbox

To confirm that custom DNS resolution is active inside Windows Sandbox:

1. Double-click CustomDnsSandbox.wsb to boot the sandbox session.
2. The PowerShell window executes and outputs the updated DNS server addresses.
3. Verify the active DNS configuration using the Get-DnsClientServerAddress cmdlet:

   Get-DnsClientServerAddress -InterfaceFamily IPv4

4. Test name resolution using Resolve-DnsName to verify that queries are routed through your configured resolvers:

   Resolve-DnsName -Name "example.com" -Type A

5. Attempt resolving domains targeted by your custom DNS sinkhole or corporate internal resolvers to confirm split-brain routing works as intended.