How to Configure DNS Devolution and Resolution Levels in Windows 11 Using PowerShell

In enterprise Active Directory environments and multi-tiered corporate networks, internal hostnames are frequently arranged under hierarchical subdomains—such as finance.corp.contoso.com or dev.lab.internal.net. When users or background automation scripts attempt to access networked resources using single-label, unqualified hostnames (for example, typing ping fileserver or connecting to http://intranet), the Windows DNS client must determine how to append domain suffixes to resolve the destination IP address.

One of the primary mechanisms Windows utilizes to accomplish this is DNS Devolution. Devolution allows the DNS client resolver to take the client’s Primary DNS Suffix and systematically strip off the leftmost labels, querying each successive parent domain until a match is found or a security devolution level boundary is reached. Configuring DNS devolution and setting appropriate devolution level thresholds via PowerShell ensures rapid resolution of internal resources while preventing unintended queries from leaking to external top-level domains.

Understanding How DNS Devolution Resolves Queries

To illustrate how devolution operates, consider a Windows 11 workstation assigned the primary domain suffix na.sales.corp.contoso.com. When an application attempts to resolve an unqualified name such as printersrv, the Windows DNS resolver follows a progressive lookup sequence:

1. First, it queries the full primary domain: printersrv.na.sales.corp.contoso.com.
2. If the primary domain lookup fails and devolution is enabled, Windows strips the leftmost label (na) and queries: printersrv.sales.corp.contoso.com.
3. If that lookup fails, it strips the next label (sales) and queries: printersrv.corp.contoso.com.
4. The process halts when it reaches the configured Devolution Level limit.

The Security Importance of Devolution Levels

Without an explicit devolution level boundary, an unconstrained DNS resolver would continue stripping domain labels until it queried printersrv.contoso.com or even printersrv.com. Querying public top-level domains for internal resources creates severe security vulnerabilities, including internal reconnaissance leakage, credential capture via WPAD (Web Proxy Auto-Discovery) spoofing, and man-in-the-middle exploits.

The Devolution Level defines the minimum number of domain labels that must remain in the suffix before devolution stops. For instance, in corp.contoso.com, there are 3 labels (corp, contoso, com). If the devolution level is set to 2, devolution can strip labels down to contoso.com (2 labels), but will never strip down to .com (1 label).

Inspecting Current DNS Devolution Settings in PowerShell

Open an elevated PowerShell prompt on Windows 11 by right-clicking Start and selecting Terminal (Admin). To query the global DNS client resolver configuration, execute the Get-DnsClientGlobalSetting cmdlet:

Get-DnsClientGlobalSetting | Select-Object UseDevolution, DevolutionLevel, SuffixSearchList

The command returns the active configuration parameters:

UseDevolution   : True
DevolutionLevel : 0
SuffixSearchList: {}

A DevolutionLevel value of 0 indicates that Windows uses the default operating system threshold, which calculates the devolution limit based on the forest root domain hierarchy.

Enabling or Disabling DNS Devolution Globally

If your organization utilizes a flat domain namespace or relies exclusively on a centralized Group Policy Suffix Search List, disabling devolution prevents unnecessary redundant queries across parent zones.

To disable DNS devolution across all network adapters on Windows 11, run:

Set-DnsClientGlobalSetting -UseDevolution $false

To re-enable DNS devolution, execute:

Set-DnsClientGlobalSetting -UseDevolution $true

Verify that the setting was committed to the local registry:

Get-DnsClientGlobalSetting | Select-Object UseDevolution

Configuring Explicit Devolution Level Thresholds

In complex multi-tenant or multi-level subdomain topologies, administrators should enforce explicit devolution levels to prevent name lookups from crossing administrative boundaries.

To configure a devolution level that requires at least two domain labels to remain in the search suffix, specify the level parameter:

Set-DnsClientGlobalSetting -DevolutionLevel 2

If your enterprise root namespace contains three labels (e.g., us.enterprise.local) and you want lookups to never devolve above the top enterprise boundary, enforce a level of 3:

Set-DnsClientGlobalSetting -DevolutionLevel 3

Confirm the new configuration:

Get-DnsClientGlobalSetting | Select-Object UseDevolution, DevolutionLevel

Testing Query Resolution and Suffix Appending

To verify how Windows 11 resolves an unqualified hostname using devolution, test name resolution using the Resolve-DnsName cmdlet. Use the -Type A and -DnsOnly parameters to inspect raw DNS responses:

Resolve-DnsName -Name "intranet" -Type A -DnsOnly

To observe the exact sequence of queries sent across the wire, open an additional terminal window and capture DNS client diagnostic events in real time:

Get-WinEvent -LogName "Microsoft-Windows-DNS-Client/Operational" -MaxEvents 10 | Format-Table -Property TimeCreated, Message -Wrap

The event logs will clearly demonstrate the primary suffix lookup followed by sequential devolved queries down to the configured devolution level limit.

Flushing the DNS Resolver Cache

Whenever you alter global DNS settings, devolution levels, or suffix search lists, flush the local DNS client cache to discard cached negative lookup responses (NXDOMAIN) from previous attempts:

Clear-DnsClientCache

By properly tuning DNS devolution and enforcing strict devolution levels in Windows 11, network administrators ensure reliable internal service discovery while preventing sensitive queries from leaking across organizational and public network boundaries.