0

I have a Windows application that publishes itself with a DNS multicast record. Let's say myapp.local.

When it is installed, it stores a record in hosts file under systemroot/drivers/etc folder.

127.0.0.1 myapp

This configuration has worked for most of my customers. Locally the server resolves "myapp" with local loopback (127.0.0.1), and all other computers in the LAN can reach the application from multicast record.

Yesterday, for the first time, I had a problem. There were 2 computers in the same LAN with myapp installed, both were publishing their names in multicast way, but the strangest thing is that one of the two computers was resolving myapp name using multicast and ignoring its local hosts file.

I thought the DNS resolution precedence in Windows was:

  1. Host name
  2. Network DNS server
  3. Multicast

But it has to be wrong, otherwise I cannot explain the multicast precedence vs hosts.

A ping command like: ping myapp answered with "myapp.local". I checked the hostname was well formed and it was the correct file in tcpip DataBasePath (Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters)

I also tried to disable multicast resolution from GPO settings:

enter image description here

After a reboot and a dns and netbios cache cleanup, it did not change.

Is the DNS resolving order wrong? How can I force to ignore multicast and set hosts with highest priority?

Tobia
  • 1,272
  • 9
  • 41
  • 81
  • `But it has to be wrong` Why? Hosts is checked before DNS, but by default Windows queries three name sources in parallel, and the first one to respond wins. I would at least disable the other two as a test. (NetBIOS/LLMNR). Also create another entry in the hosts file for a host that does not exist to ensure it is using the file to resolve names. – Greg Askew Sep 15 '22 at 11:06
  • Thanks for the tip, i'll try. I cannot belive the MDNS is faster than hosts file... – Tobia Sep 15 '22 at 12:02
  • 1
    I believe there also used to be a setting to reorder how names are resolved. You may want to run Sysinternals ProcMon to track the activity during the resolution attempt. – Greg Askew Sep 15 '22 at 12:17

0 Answers0