How to Configure Multicast DNS (mDNS) Resolution in Windows 11 Using PowerShell

In modern local area networks, connecting to local network printers, IoT smart appliances, NAS storage units, and cross-platform Apple/Linux devices often relies on zero-configuration networking (Zeroconf). Multicast DNS (mDNS), defined in RFC 6762, enables devices to resolve .local domain names without requiring a central DNS server or Active Directory domain controller. In Windows 11, the native DNS client stack includes robust mDNS capabilities that network administrators can configure, query, and secure using elevated PowerShell cmdlets.

How Multicast DNS Operates on Local Intranet Segments

Traditional DNS queries are directed to unicast server addresses (such as 192.168.1.1 or public resolvers). In contrast, mDNS operates over local multicast channels:

• Multicast addressing: Outbound lookup packets are broadcast to UDP port 5353 using the standard IPv4 multicast address 224.0.0.251 and IPv6 address ff02::fb.
• Zero-configuration resolution: When a client queries nas-backup.local, the target storage appliance listening on the multicast address responds with its own IP coordinates, allowing immediate peer-to-peer resolution.
• Replacing legacy protocols: mDNS provides a modern, standardized replacement for legacy Microsoft NetBIOS over TCP/IP and Link-Local Multicast Name Resolution (LLMNR), which are increasingly disabled due to credential poisoning vulnerabilities.

Querying Active mDNS Settings via PowerShell

Windows 11 manages mDNS configuration both at the global system level and per individual network interface. To inspect the current operational status, open an elevated PowerShell prompt (Right-click Start > Terminal (Admin)).

Query the DNS client properties for all active network adapters using the Get-DnsClient cmdlet:

Get-DnsClient | Select-Object InterfaceAlias, InterfaceIndex, ConnectionSpecificSuffix, EnableMulticast

The EnableMulticast boolean property indicates whether multicast resolution protocols (including mDNS and LLMNR) are permitted on each network adapter.

To inspect mDNS policy settings enforced through Group Policy or the system registry, query the DNS client parameters key:

Get-ItemProperty -Path "HKLM:SOFTWAREPoliciesMicrosoftWindows NTDNSClient" -Name "EnableMulticast" -ErrorAction SilentlyContinue

Enabling or Disabling mDNS per Network Interface

Depending on network security policies, administrators may wish to enable mDNS on private home or office Wi-Fi networks while disabling it across public or corporate virtual private network (VPN) tunnels.

1. Enabling mDNS on Wi-Fi or Ethernet

To ensure mDNS is active on your primary local network connection, specify the adapter’s interface alias:

# Enable multicast on the primary Wi-Fi interface
Set-DnsClient -InterfaceAlias "Wi-Fi" -EnableMulticast $True

# Enable multicast on the primary Ethernet interface
Set-DnsClient -InterfaceAlias "Ethernet" -EnableMulticast $True

2. Disabling mDNS on High-Security or VPN Adapters

To prevent broadcast traffic from leaking over enterprise VPN tunnels or untrusted guest adapters, disable multicast resolution on those specific interfaces:

Set-DnsClient -InterfaceAlias "Corporate VPN" -EnableMulticast $False

Enforcing System-Wide mDNS Policy via PowerShell Registry Automation

For fleet management across non-domain or standalone Windows 11 machines, script registry policies to standardize mDNS behaviours:

$RegPath = "HKLM:SYSTEMCurrentControlSetServicesDnscacheParameters"

# Enable mDNS resolution (Value 1 = Enabled, 0 = Disabled)
Set-ItemProperty -Path $RegPath -Name "EnableMDNS" -Value 1 -Type DWord

# Restart the DNS Client cache service to apply adjustments
Restart-Service -Name "Dnscache" -Force

Testing and Validating mDNS Lookups

To confirm that Windows 11 is actively resolving local .local hostnames through mDNS:

1. Use the Resolve-DnsName cmdlet with a known .local appliance address:

   Resolve-DnsName -Name "printer-office.local" -Type A

2. Check the query resolution source in the output summary. If successful, Windows returns the target device’s IP address and confirms resolution via multicast.
3. Use ping.exe to verify end-to-end communication:

   ping printer-office.local

Verifying Windows Defender Firewall Rules for mDNS

If mDNS queries fail to receive responses, verify that Windows Defender Firewall is permitting inbound and outbound UDP port 5353 traffic on private network profiles:

Get-NetFirewallRule -DisplayName "*mDNS*" | Format-Table DisplayName, Direction, Action, Enabled, Profile

Ensure rules assigned to the Private profile indicate Action: Allow and Enabled: True, allowing peer devices to communicate transparently.