How to Query and Inspect the DNS Client Cache in Windows 11 Using PowerShell

Whenever you connect to a website, cloud resource, or network share on Windows 11, the Windows DNS Client service resolves hostnames into IP addresses via configured DNS recursive resolvers. To minimise latency and reduce redundant network round-trips, Windows caches these DNS resolution responses locally in memory according to each record’s Time-To-Live (TTL) specification.

While the legacy Command Prompt utility ipconfig /displaydns prints the entire cache as an unformatted text block, PowerShell provides modern, object-oriented cmdlets to query, filter, sort, and export DNS cache entries. Using the Get-DnsClientCache cmdlet, administrators and troubleshooting engineers can quickly identify stale records, negative cache entries (NXDOMAIN), and TTL expirations. This guide explains how to query and inspect the DNS client cache in Windows 11 using PowerShell.

---

Why Inspect the Local DNS Client Cache?

Querying the local DNS client cache provides vital diagnostic clues during network troubleshooting sessions:

• Diagnosing Website Access Failures: If a web service or internal server recently migrated to a new IP address, checking the cache confirms whether Windows is still referencing an outdated IP.
• Detecting Negative Cache Poisoning: If an initial DNS query failed, Windows caches the negative response (NXDOMAIN) for a brief duration. Inspecting the cache reveals whether requests are blocked by negative caching rather than active network outages.
• Monitoring Time-To-Live (TTL) Decay: PowerShell exposes the remaining TTL in seconds, allowing you to observe record expiration in real time before Windows initiates a fresh lookup.
• Auditing Unauthorised Network Connections: Reviewing cached hostnames can expose background processes or malware binaries querying suspicious command-and-control domains.

---

Step 1: Open PowerShell in Windows 11

The Get-DnsClientCache cmdlet does not require administrative elevation to read standard cached records, though elevated privileges are helpful when examining system-wide or service accounts:

1. Right-click the Start button on your taskbar (or press Win + X).
2. Select Terminal or PowerShell.

---

Step 2: Query the Entire DNS Client Cache

To display all currently cached DNS records on your Windows 11 system, execute:

Get-DnsClientCache

To present the records in a structured, readable tabular format, pipe the output into Format-Table:

Get-DnsClientCache | Format-Table Entry, Type, Status, TimeToLive, Data -AutoSize

Key Property Descriptions:

• Entry: The Fully Qualified Domain Name (FQDN) or hostname queried.
• Type: The DNS record type (e.g., 1 for A records, 28 for AAAA IPv6 records, 5 for CNAME aliases, 15 for MX mail records).
• Status: The query outcome (0 indicates a successful resolution, while status 9003 indicates NXDOMAIN / non-existent domain).
• TimeToLive: The remaining lifespan of the cached entry in seconds before it expires and is purged.
• Data: The resolved IP address or canonical name alias.

---

Step 3: Filter Cache by Specific Domain Names

In high-traffic environments, the DNS cache can contain hundreds of active records. You can filter for specific domains using wildcards:

# Query a specific domain
Get-DnsClientCache -Entry "microsoft.com"

# Query all domains matching a pattern
Get-DnsClientCache | Where-Object { $_.Entry -like "*google*" } | Format-Table Entry, Status, TimeToLive, Data -AutoSize

---

Step 4: Filter for Failed or Negative (NXDOMAIN) Cache Entries

When troubleshooting network connectivity issues where a domain cannot be reached, filter for non-zero status codes to catch negative responses:

Get-DnsClientCache | Where-Object { $_.Status -ne 0 } | Format-Table Entry, Status, TimeToLive -AutoSize

If you see a domain listed with status 9003 (DNS_ERROR_RCODE_NAME_ERROR), Windows will immediately return an error without consulting your DNS server until the TTL expires or the cache is cleared.

---

Step 5: Export DNS Cache to CSV for Network Auditing

For documentation, fleet security audits, or forensic analysis, export the active DNS cache to a structured CSV file:

Get-DnsClientCache | Select-Object Entry, Type, Status, TimeToLive, Data |
    Export-Csv -Path "$env:USERPROFILE\Desktop\DNS_Cache_Audit.csv" -NoTypeInformation -Encoding utf8
Write-Host "DNS Cache exported to Desktop successfully." -ForegroundColor Green

---

Step 6: How to Flush the DNS Client Cache in PowerShell

If you determine that an incorrect, corrupted, or stale record is lingering in memory, flush the DNS cache immediately using PowerShell’s dedicated cmdlet:

Clear-DnsClientCache

After executing this command, run Get-DnsClientCache again to verify that the cache has been emptied, forcing Windows to perform fresh DNS lookups.

---

Troubleshooting Common DNS Cache Inconsistencies

Domain Shows in Cache but Browser Displays DNS_PROBE_FINISHED_NXDOMAIN

Modern web browsers such as Google Chrome and Microsoft Edge maintain their own internal DNS socket pools and host caches independent of the Windows operating system cache. If you cleared the Windows cache but still encounter resolution errors in your browser, navigate to chrome://net-internals/#dns (or edge://net-internals/#dns) and click Clear host cache.

Get-DnsClientCache Cmdlet Returns Nothing

If Get-DnsClientCache returns a blank output, your local cache may have recently expired, or third-party security software may have disabled the Windows DNS Client service (Dnscache). Verify that the service is running:

Get-Service -Name "Dnscache"

---

Frequently Asked Questions

What is the difference between ipconfig /displaydns and Get-DnsClientCache?

While ipconfig /displaydns outputs raw, unfilterable console text that is difficult to parse programmatically, Get-DnsClientCache outputs structured .NET objects. This allows administrators to pipe data directly into Where-Object, Select-Object, Export-Csv, and remote orchestration scripts.

How long does Windows 11 keep DNS records in cache?

Windows caches successful DNS responses according to the authoritative TTL returned by the DNS server, up to a default maximum limit of 86,400 seconds (1 day). Negative responses (NXDOMAIN) are cached for significantly shorter windows, typically defaulting to 300 seconds (5 minutes).

Can I query the DNS cache of a remote Windows PC?

Yes. If PowerShell Remoting is enabled in your Active Directory domain or network environment, use Invoke-Command -ComputerName "Workstation01" -ScriptBlock { Get-DnsClientCache } to inspect the cache of remote endpoints across the network.