I have a machine that has a LAN network connection, which is used for internet access. This machine also has to be connected to a VPN connection. When the VPN is connected, Windows seems to ask the DNS servers of the VPN connection first, then the DNS servers configured for the LAN connection. I need this to be the other way around for performance issues, since the VPN is slow.

So, how do I configure which of the connection's DNS servers should be the primary on a Windows box ? The remote VPN DNS provides some name resolution that are not public, so I still need it.

I have already unchecked the "Use the default gateway on the remote network" option in TCP/IP settings.


I am experimenting on a Windows 7 box, but I really need to be able to do it on both Windows Server 2003 and Windows 7.

I think my route table are OK. is my local gateway, while is that of the VPN connection.

IPv4 Route Table
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
     20         On-link    276         On-link    276         On-link    276         On-link    306         On-link    306         On-link    306     21         On-link    276     21         On-link    306         On-link    276         On-link    306         On-link    276         On-link    276
Persistent Routes:

When I go to Network Connections -> Advanced settings to change network binding order, I can only view the following connections: Local Area Connection and [Remote Access Connections], where Local Area Connection is listed first. The VPN connection I am using is not listed (while it does exist in the "Network connections" window).

4 Answers 4


From the way your question is worded, it seems your expectation is that when Windows needs to resolve a name, it will ask the primary DNS server. And if the primary DNS server doesn't know the answer, it will then ask the secondary.

I hope the above isn't what you were expecting, but if it is, then let me show you why that's a mistake.

DNS doesn't work that way. The only time a resolver will failover to the secondary DNS server is when the primary does not respond at all. An example will clarify:

Suppose you have a primary DNS server at and a secondary at Your client is configured with them in this order. hosts a a private zone foocompany.local; hosts no zones of its own, and does root lookups for internet hosts.

If your client tries to lookup someserver.foocompany.local, will return NXDOMAIN (eg "I queried the root servers and they say that domain does not exist"). Your resolver will not then ask what it knows, unless fails to reply within the timeout period (usually 2 seconds). It'll just quit looking. Further, your client will cache the NXDOMAIN result, as per RFC2308. Even if you change NIC settings such that is the primary server, you'll still get NXDOMAIN results until that local NXDOMAIN cache is expired. You can verify this by issuing ipconfig /displaydns at the command prompt.

IIRC, Windows' DNS resolver caches NXDOMAIN for a short time - 5 minutes. But still this can be annoying.

Anyhow. I realize this is a little bit tangential to your problem, but clarifying this point may bring about an epiphany for your planned design. EG: you may want the VPN's DNS server first to resolve after all. Although it is a tad slower, it knows more, since it can resolve both the domains private to the VPN and public internet domains; whereas the local LAN DNS resolver knows nothing of those domains private to the VPN.



It sounds like you want to set up split tunnelling. First, verify that your VPN software is setting up routing on your client PC correctly. The command:

route print

Will display the routing table of your client host. You should have an entry for your office(?) network that points to the default gateway of your VPN interface. The main thing is that your default route with the lowest metric points to the default gateway of your LAN interface.

Once you have confirmed that routing is configured correctly, the next thing to check is the binding order of your network interfaces. This is the order in which various network services try each of your network adapters. Instructions on how to change it on Windows XP can be found here.

I can't find a similar KB article for Vista, but in summary:

From the 'Network Connections' window:

Organize -> Layout -> Menubar

The menu bar will appear. From there:

Advanced -> Advanced Settings

Will get you into the options dialogue you need. In your case, your VPN adapter should be listed below your LAN interface.

NOTE: changing the binding order so that your local internet connection is used first could cause different issues relating to name resolution for hosts on your VPN network. It's difficult to determine without more information.

EDIT: Having thought about this a little more, I'm not sure how you could not use your VPN DNS when connected to your VPN. If you use internet DNS servers, then you wouldn't be able to resolve anything on the VPN that wasn't in public DNS. The only way I could think to do it would be to configure a local DNS server, and having it forward queries for your VPN DNS zone (*.local, from your example) to, and everything else to your ISPs DNS server.

Is using the company DNS server really causing you that much of a performance hit? Every resolution will be cached, and your actual data traffic will go direct onto the internet, bypassing your VPN.

  • Thanks for your answer; I have checked the things you suggest but am still having trouble. I updated my question with more info, in case that might help in solving this.
    – driis
    May 22, 2009 at 17:14
  • Can you paste the output of 'nslookup www.google.com' to confirm what DNS server you are resolving against? May 22, 2009 at 20:16
  • Yes: Server: serverdc.company.local Address: Non-authoritative answer: Name: www.l.google.com Addresses: Aliases: www.google.com
    – driis
    May 22, 2009 at 20:48

When the VPN is connected, Windows seems to ask the DNS servers of the VPN connection first, then the DNS servers configured for the LAN connection.

This is normal.

Most VPNs support a split-view and/or private view mode, where you have to ask for the internal DNS first, otherwise the public DNS would return the external address or NXDOMAIN.

I need this to be the other way around for performance issues, since the VPN is slow.

It may be possible to work around this but only if your internal DNS zone is completely private (i.e. using a fake TLD such as ".local"). As per Murali's answer, you'd need to run a local DNS server which forwards the query either to the VPN or to the public DNS depending on the suffix.


This is an old question, but I came across it while working on something similar, and have a bit of extra info to add:

  1. While quux is technically correct, in reality Windows does allow this behavior. The 'Use the default gateway on the remote network' option does exactly that; when checked, if local DNS returns NXDOMAIN, Windows then tries VPN DNS. That's not coming into play here, since Windows is trying VPN first to begin with. But if he could change that order, then having that option checked would give him exactly the behavior he was looking for.

  2. There is a way to do what you want, because I just made it happen. My home network used to rely on my router's built-in DHCP server, set to advertise the OpenDNS servers. I recently set up a DHCP+DNS server on a separate machine on the network, set to forward to OpenDNS for non-local addresses.

    For some reason, this changed how Windows prioritizes DNS servers. Before, it would use VPN DNS first (my desired behavior), now it uses the local DNS first (your desired behavior). If I turn off my local DHCP+DNS and go back to using my router, the VPN goes first again.

This info may help you identify the problem...if you do figure it out, let me know, since I'm trying to figure out how to do the opposite.

Note: I know this should perhaps be a comment, but there's a rep requirement...

  • This is an excellent point. I verified that XP and Windows 2003 will do DNS first via VPN adaptor at support.microsoft.com/kb/942440 - I have yet to confirm (from authortative source - nothing personal) that it will ask via the NIC's configured DNS server on NXDOMAIN response from VPN's DNS server.
    – quux
    Aug 17, 2009 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .