How to Configure DNS Client Cache Parameters in Windows 11 Using PowerShell

The Windows DNS Client service (Dnscache) maintains an internal in-memory cache of previously resolved Domain Name System records. This caching mechanism drastically accelerates web browsing and network operations by eliminating redundant network round trips to upstream recursive resolvers. However, when domain records change or during network testing, stale cache entries can lead to connection failures. PowerShell provides administrators with cmdlets and registry controls to inspect, configure TTL thresholds, and manage the Windows 11 DNS client cache.

How the Windows DNS Client Cache Operates

When an application attempts to connect to a remote host (such as api.example.com), the Windows DNS client checks its local cache before querying configured DNS servers. Two types of records are stored in this cache:

• Positive Responses: Successful queries that return valid IP addresses. These records are cached according to the Time-To-Live (TTL) returned by authoritative DNS servers, capped by the Windows MaxCacheTtl parameter.
• Negative Responses: Failed queries (such as non-existent domains or NXDOMAIN). These prevent applications from repeatedly flooding network resolvers with doomed requests, regulated by MaxNegativeCacheTtl.

Querying the Active DNS Client Cache in PowerShell

To inspect records currently retained inside the Windows 11 DNS client cache:

1. Right-click the Start button on Windows 11 and select Terminal (Admin) or PowerShell.
2. Execute the Get-DnsClientCache cmdlet:

   Get-DnsClientCache

3. To filter for a specific domain name or record type (such as A or AAAA records):

   Get-DnsClientCache -Entry "microsoft.com"
   Get-DnsClientCache | Where-Object { $_.Type -eq 1 } | Select-Object Entry, Data, TimeToLive

4. The output displays the cached hostname, resolved IP data, and remaining TimeToLive in seconds.

Flushing and Clearing the DNS Client Cache

When remote server IP addresses change and local applications continue resolving outdated endpoints, flush the local resolver cache:

Clear-DnsClientCache

This cmdlet purges all non-static entries immediately. Verify the cache is empty by running Get-DnsClientCache.

Configuring DNS Client Cache TTL Limits in Windows 11

By default, Windows caps the maximum time any positive DNS entry can be cached at 86,400 seconds (1 day) and negative responses at 5 seconds. In testing or dynamic cloud development environments, administrators often prefer lower positive TTL caps to ensure rapid DNS cutover.

Configuring Maximum Positive Cache TTL (MaxCacheTtl)

To restrict the maximum lifetime of positive DNS responses to 5 minutes (300 seconds) via PowerShell:

$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters"
Set-ItemProperty -Path $regPath -Name "MaxCacheTtl" -Value 300 -Type DWord

Configuring Negative Cache TTL (MaxNegativeCacheTtl)

To prevent Windows from remembering NXDOMAIN or lookup failures for prolonged periods during domain setup:

Set-ItemProperty -Path $regPath -Name "MaxNegativeCacheTtl" -Value 0 -Type DWord

Setting this value to 0 disables negative caching entirely, forcing Windows to query upstream resolvers on every retry.

Auditing and Testing DNS Resolution with Resolve-DnsName

To test how the DNS client resolves queries against specific upstream servers without relying on cached data:

Resolve-DnsName -Name "example.com" -NoHostsFile -Type A

Or query an authoritative server directly to inspect raw TTL values:

Resolve-DnsName -Name "example.com" -Server 1.1.1.1

Restarting the DNS Client Service

After modifying registry parameters for Dnscache, restart the service to apply changes:

Restart-Service -Name "Dnscache" -Force

Note: On certain modern Windows 11 editions, the Dnscache service is protected against direct user-mode restarts. A quick system reboot guarantees that newly configured cache parameters take effect.