Resolve-DnsName vs. nslookup in Windows

The last time I talked about a networking tool, the infamous iPerf3 article, I kicked up a hornet’s nest online. The choice of tool you pick to diagnose name resolution, such as DNS, inside Windows can impact the accuracy of your troubleshooting. This article is going to discuss the option every Windows admin knows, nslookup, versus the newer kid on the block, PowerShell’s Resolve-DnsName.

It works, it works everywhere, and it works (mostly) well. But, because these articles always have a but, it has some quirks that you may not be aware of. When an application inside Windows resolves a computer or a domain name, like mapping a drive in File Explorer, it makes one of a handful of API calls.

Those API calls will almost always end up at DnsQueryEx. It does not make any name resolution Windows API calls. When no Windows-centric troubleshooting is involved, and you just need to resolve an IP address from a DNS server, then nslookup is great.

Or, if you suspect that the Windows DNS client resolver (DNS-CR) is acting up, use nslookup. When nslookup works but a Windows process does not, then there is a good chance that there is a Windows, DNS policy, or endpoint protection related issue. The bad part means that nslookup does not match the name resolution behaviors used by Windows roles, features, services, apps, and most programs running on Windows..