If you suspect someone used your computer to visit a malicious website, checking the Google Chrome browser history might not help—they likely used Incognito mode or deleted their history. However, Windows 11 maintains a separate, hidden network log at the operating system level known as the DNS Resolver Cache.
Every time any application on your computer (a browser, a video game, or a hidden malware script) connects to a server, Windows records the exact web address (like “google.com”) and its corresponding IP address. You can safely extract this entire cache using the Command Prompt to see exactly what websites have been accessed since the computer was turned on.
How to Safely Extract the Windows 11 DNS Resolver Cache
You must use the `ipconfig` utility to dump the hidden networking log.
- Click the Start button, type cmd, and press Enter to launch the Command Prompt.
- To extract the raw cache data and display it on your screen, carefully type the following exact command:
ipconfig /displaydns - Press Enter.
- The terminal will output a massive list of records. Because the list is so long, you might want to extract it directly into a text document instead of reading it in the terminal. Type this command to dump the data to a text file on your C: drive:
ipconfig /displaydns > C:\dns_log.txt - Press Enter. (If you get an access error, change the path to your Desktop, e.g.,
> C:\Users\YourName\Desktop\dns_log.txt).
Open the generated text file. Look specifically for the lines labeled Record Name. This will reveal the exact domain names (like cdn.discordapp.com or update.microsoft.com) that your computer has recently communicated with. Note that this cache resets every time you reboot your computer, so you must extract the log before shutting down.