DNS Suffix Search List

meebers · 04 Jun 2019

Was poking around this AM to see if my DNS server selection could be improved or if it was ok. After Running Gibson's DNSBench.exe several times, convinced me I was already on the "best" one (openDNS).

When I did an IPconfig /all, I am looking at something that has puzzled me for a while and that is DNS Suffix Search List is listed as T-Mobile.com1?

OpenDNS is set on my computer, as well as in the Wan DNS1/2 on the router. I am using a Tmobile/ASUS TM-AC 1900 and T-Mobile.com1 is listed as the router Domain name?

Appreciate any clarity on this...Tx

EdTittel · 04 Jun 2019

If you have automatic DNS provisioning set up in your TCP/IP properties (see this article: http://compinfopro.com/dns-suffix-what-does-it-mean/) it's probably getting its initial DNS info/access through the router, and that's where the domain name and initial lookup is originating. That said, if it's working properly and you're happy with its performance and behavior, remember the old saying "If it ain't broke, don't fix it!"
HTH,
--Ed--

meebers · 04 Jun 2019

Tx ED, read the link twice

will read it again until I can make some sense of it.

EdTittel · 06 Jun 2019

You're welcome. Hope it all starts making some kind of sense soon! If not, I wrote a TCP/IP textbook that I can recommend. It's now in it's 5th edition, so it must be OK.

--Ed--

davidpetraitis · 28 Jul 2020

Ed,
I'd like an update on this discussion. From the point of view of security and data leakage.

I bought a computer from China, and the router from my internet provider, TELMEX, is from Huawei. I have a suffix pointing to Huawei.net. I would like to limit the amount of DNS queries that go to China, or for that matter Google, since you cannot be sure how they will mine the data these days.

David

TairikuOkami · 29 Jul 2020

Just disable DNS Client (DNS Cache) service, it will take care of it, not to mention, it is vulnerable anyway.

The Primary DNS Suffix is what the DNS Client Service (partly the DNS Dynamic Update Service) on the DC uses to register the AD information into DNS looking for a matching zone name, which is domainame( eg Contoso.com) zone. If this is missing, AD (specifically the netlogon service) can't regsiter its data into DNS.

What is DNS cache poisoning? | DNS spoofing