Svchost outgoing to external DNS servers other than my local DNS results in lagging network applications

Adrian Ząbczyk 5 Reputation points
2023-12-04T22:35:44.6666667+00:00

Svchost.exe is trying to reach external DNS servers (UDP Port 53) despite local DNS configuration and this results in lagging applications and exposing DNS data to the internet.

I have logged outgoing traffic from svchost (local IP, windows 10 endpoint): <list of destination IP> UDP dest port 53.

List of IP:

193.0.9.2 who is: RIPE-NCC-AUTHDNS
196.216.169.11 who is: ORG-AFNC1-AFRINIC
199.180.182.53 who is: ARIN Operations
199.253.182.182 who is: ARPA-DNS-SERVERS
200.7.86.53 who is: LACNIC - Latin American and Caribbean IP address
203.119.86.101 who is: APNIC-SERVICES

My local DHCP server is providing my local DNS servers IPs.

DNS IP are correct on Windows 10 endpoints.

My local DNS service is working properly.

Local DNS service is using DoH for forwarding requests.

On local network firewall only DNS requests from LAN are allowed to local DNS servers.

In local network Only DNS servers are allowed to forward DNS requests to external servers.

I have temporarily disabled blocking rules and applications stopped lagging. Looks like lagging is caused by DNS request timeouts before it reaches my local DNS.

This creates following questions/issues:

Why svchost is trying to reach these external DNS servers? What is the reason?

I assume if the DNS request data is outgoing to port 53. Based on the DNS protocol this means the data is in clear text and is exposed to the interned.

Considering corporations policies (spying) this looks like tracking customers and exposing their data to the internet and in result lagging network applications.

Can someone explain this behavior?

Windows for business | Windows Client for IT Pros | User experience | Other
0 comments No comments
{count} vote

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.