DNS and DHCP Health Check

Good For

• one Windows server or client fails DNS while peers work

• split DNS and conditional forwarding incidents

• VPN name-resolution differences

• DNS suffix and resolver-path drift

• evidence-first escalation

How to Use It

1. Run the same collection on the affected Windows client and on a known-good client that can resolve the same target; do not compare the broken client only to a DNS server.

2. Compare interface, IPv4 address, connection-specific DNS suffix, global suffix search list, and assigned DNS servers side by side.

3. Test TCP 53 reachability from each client to every configured DNS server so an unreachable resolver does not masquerade as a record problem.

4. Compare the default resolver result with a direct query to the known-good internal DNS server on both clients.

5. Inspect relevant DNS client-cache entries read-only before flushing anything.

6. Treat the first meaningful difference in suffix, resolver, route, cache, or query answer as the current failure boundary.

7. Only after the failing state is preserved should an approved cache flush, DHCP renew, DNS record correction, or network change be considered.

Execution Modes

• local

Inputs and Outputs

Inputs

• target hostname
• affected Windows client
• known-good Windows client
• expected internal DNS server
• expected suffix/search-list context

Outputs

• verbose-console
• operator-notes

Command Starter

# Run this collection on BOTH the affected client and a known-good comparison client.
$Target = 'app01.corp.example'
$ExpectedDnsServer = '10.10.10.10'
$Config = Get-NetIPConfiguration | Where-Object { $_.IPv4Address -and $_.IPv4DefaultGateway } | Select-Object -First 1
$DnsClient = Get-DnsClient | Where-Object { $_.InterfaceAlias -eq $Config.InterfaceAlias }
$DnsServers = Get-DnsClientServerAddress -InterfaceIndex $Config.InterfaceIndex -AddressFamily IPv4
$GlobalSearchList = (Get-DnsClientGlobalSetting).SuffixSearchList
$CacheMatch = Get-DnsClientCache | Where-Object { $_.Entry -like "*$Target*" -or $_.Name -like "*$Target*" }
$ResolverReachability = foreach ($Server in $DnsServers.ServerAddresses) { [pscustomobject]@{ Server = $Server; Tcp53 = Test-NetConnection -ComputerName $Server -Port 53 -InformationLevel Quiet -WarningAction SilentlyContinue } }
$DefaultLookup = Resolve-DnsName -Name $Target -ErrorAction SilentlyContinue
$DirectLookup = Resolve-DnsName -Name $Target -Server $ExpectedDnsServer -ErrorAction SilentlyContinue
[pscustomobject]@{ ComputerName=$env:COMPUTERNAME; ClientIPv4=($Config.IPv4Address.IPAddress -join ', '); InterfaceAlias=$Config.InterfaceAlias; ConnectionSpecificSuffix=$DnsClient.ConnectionSpecificSuffix; GlobalSuffixSearchList=($GlobalSearchList -join ', '); ClientDnsServers=(($DnsServers.ServerAddresses | Sort-Object -Unique) -join ', '); DnsServersReachableOnTcp53=(($ResolverReachability | ForEach-Object { "$($_.Server)=$($_.Tcp53)" }) -join '; '); DefaultLookupAnswers=($DefaultLookup.IPAddress -join ', '); DirectLookupAnswers=($DirectLookup.IPAddress -join ', '); MatchingCacheEntries=@($CacheMatch).Count }

Validation

• Affected and known-good client evidence is captured in the same format.

• DNS suffix/search-list, resolver assignment, resolver reachability, cache state, and query answers are explicitly compared.

• The first meaningful difference is documented, or the evidence shows that the failure boundary lies beyond the Windows DNS client.

• Any later remediation can be compared against the preserved before-state.

Reporting

• Capture one evidence object from each client and place them side by side in the incident record.

• Record the first differing field and the next owner or layer being investigated.

• Keep before-and-after query results if remediation is approved.

Safety Notes

• The evidence pass is read-only.

• Do not flush DNS cache, renew DHCP, change DNS servers, edit records, or restart services until the failing evidence is captured.

• TCP 53 reachability is a path check; it does not prove the resolver will answer the requested name correctly.