4

Is there a command or anything in Windows that let me view the list of the domain names that are currently resolved by the system?

Something similar to the arp command but for domain names.

Thanks.


EDIT:
I've been doing some testing with the command given by Matt, and I noticed that domain names that have a low refresh time and/or retry time, are not showed in the list given by ipconfig.

For example, google.com doesn't appear in my list, but according to the the dns responce it should be cached:

google.com
    primary name server = ns1.google.com
    responsible mail addr = dns-admin.google.com
    serial  = 2009052800
    refresh = 7200 (2 hours)
    retry   = 1800 (30 mins)
    expire  = 1209600 (14 days)
    default TTL = 300 (5 mins)

Whereas serverfault.com, which has higher refresh and retry times, does appear on the list given by ipconfig.

serverfault.com
    primary name server = ns21.domaincontrol.com
    responsible mail addr = dns.jomax.net
    serial  = 2009031400
    refresh = 28800 (8 hours)
    retry   = 7200 (2 hours)
    expire  = 604800 (7 days)
    default TTL = 86400 (1 day)

The following is another domain which is never shown by ipconfig, even though it has a high TTL:

minijuegostop.com.mx
    primary name server = ns1.theplanet.com
    responsible mail addr = support.minijuegostop.com.mx
    serial  = 2008122302
    refresh = 900 (15 mins)
    retry   = 900 (15 mins)
    expire  = 1209600 (14 days)
    default TTL = 86400 (1 day)

Apparently Windows decide not to cache some domains, and the refresh and retry times has something to do with it. Either that or Internet Explorer maintains its own domain name list. But I dont think so because as soon as I open a new webpage, the domain name of that page is shown by the ipconfig command; unless it has a low refresh or retry time, in which case it's not shown in the list.

Does anyone know what could be the problem or whether it's possible to show a complete list of cached domain names? (becasue apparently the list given by ipconfig is not complete)

1
  • 2
    Do you mean currently cached by the resolver? If so, then Matt Simmons' answer is what you're looking for.
    – squillman
    May 28, 2009 at 20:03

4 Answers 4

10

ipconfig /displaydns

2

Run the following commands in order:

  1. ipconfig /flushdns
  2. ping google.com.
  3. ipconfig /displaydns

This (or something very similar) is what you should see, unless something (probably malware) is messing with your DNS resolution:

C:\>ipconfig  /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\>ping google.com.

Pinging google.com [74.125.45.100] with 32 bytes of data:
Reply from 74.125.45.100: bytes=32 time=36ms TTL=50
Reply from 74.125.45.100: bytes=32 time=32ms TTL=50
Reply from 74.125.45.100: bytes=32 time=40ms TTL=50
Reply from 74.125.45.100: bytes=32 time=38ms TTL=50

Ping statistics for 74.125.45.100:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 32ms, Maximum = 40ms, Average = 37ms

C:\>ipconfig  /flushdns

Windows IP Configuration

    google.com
    ----------------------------------------
    Record Name . . . . . : google.com
    Record Type . . . . . : 1
    Time To Live  . . . . : 140
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 209.85.171.100


    Record Name . . . . . : google.com
    Record Type . . . . . : 1
    Time To Live  . . . . : 140
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 74.125.67.100


    Record Name . . . . . : google.com
    Record Type . . . . . : 1
    Time To Live  . . . . : 140
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 74.125.45.100



C:\>
1
  • Doing some more testing I realized the problem was the computer I was doing the testings on, which is a WinXP SP3. I did what you say on a WinXP SP2 machine and it works fine. However on the WinXP SP3 one, it doesn't (or may be the problem is something alse, like my AVG antivirus --who knows).
    – GetFree
    Jun 2, 2009 at 8:24
1

Regarding your edited question regarding some DNS entries with a low TTL missing from the cache, check out this google search which will explain all:

http://www.google.com/search?q=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNSCache\Parameters++site%3Amicrosoft.com

0

For example, google.com doesn't appear in my list, but according to the the dns responce it should be cached:

  google.com
      primary name server = ns1.google.com
      responsible mail addr = dns-admin.google.com
      expire  = 1209600 (14 days)
      default TTL = 300 (5 mins)

The value that controls how long a record is cached for is the TTL (Time to live), not the retry or refresh. The default TTL for Google according to what you posted is 5 minutes, but a specific record can have a much lower TTL. In my testing the TTL for A records associated with www.google.com records tend to between 30-60 seconds. If you aren't hitting Google and then immediately checking the cache, it is possible the record has expired too fast for you to notice. Try doing a ping www.google.com and then running ipconfig /displaydns immediately.

1
  • That's what I've been doing. Pinging and browsing to the 3 domains in my examples (and many others) and then checking if the output of ipconfig shows them. google.com and minijuegostop.com.mx never appear in that list.
    – GetFree
    May 28, 2009 at 22:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .