Windows – HOSTS file not overriding DNS

I believe nslookup is used to test a DNS server itself, as opposed to utilizing your HOSTS file. http://support.microsoft.com/kb/200525 seems to indicate as much.

Try just a simple ping. Does ping myMachine.MyDnsSuffix resolve to the loopback address you have specified in your HOSTS file?

It appears from what you're saying that the request for windows.cs is going to the ISPs DNS server now and again. The nxdomain result is then cached by Windows' DNS client, and thus used for any retries with a web browser, ping etc. Clearing the cache (ipconfig /flushdns) should force the Windows DNS client to retry the query, but there's no guarantee it won't go to the ISP DNS server again.

The reason ping can't resolve the hostname but nslookup can is because nslookup a low-level tool that bypasses the Windows DNS client. It uses whatever DNS server you tell it to (the first one by default), and does the query on the fly. You can change the DNS server it queries by typing server <host> from the nslookup prompt, where host is the IP or FQDN.

The Windows DNS client however will only do queries for entries that are not in its cache (or have expired). Otherwise it returns the cached result.

It's not immediately apparent why the Windows client is using the ISP DNS server. Perhaps it could not resolve the local server recently (due perhaps to being on another network), perhaps the local server was returning errors. Or, perhaps it is not ordered correctly under Advanced TCP/IP settings > DNS.

Personally I prefer to only use local DNS server addresses on workstations (propagated by DHCP), to simplify configuration and avoid issues like this. I'd be curious to know the rationale behind setting the ISPs DNS server on desktops. I can't imagine there being any valid performance reasons, and as far as redundancy goes two is enough on most networks (if not add a third).