I've got a Windows 10 PC which is connected to a VPN network which has a DNS server, is there anyway in Windows to only route DNS queries which have a .local suffix to the VPN, and have the rest of the traffic leave via the internet interface? The VPN does not force all traffic to go through it.

1 Answer 1


Yes, this is possible on Windows 7+ using the name resolution policy table. This allows you to set a different set of DNS servers for a given namespace. This is the table used by DirectAccess to direct some traffic over the DirectAccess tunnels.

Here are a couple example powershell commands you can used to manage the policy table and setup a policy for .local.

Add rule to send .local to over vpn

$Rule = @{
    'Namespace'   = '.local'
    'Comment'     = 'VPN network'
    'NameServers' = ('fdab:25f9:a362:58::2', 'fdab:25f9:a362:58::3')
Add-DnsClientNrptRule @Rule

Verify DNS resolution is working (nslookup will not use the policy table)

Resolve-DnsName 'example.local' -Type A_AAAA

Remove NRPT rules

Get-DnsClientNrptRule | Where { $_.Namespace -eq '.local' } | Remove-DnsClientNrptRule

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.