Our company is considering configuring workstations with static DNS servers that point to a managed cloud resolver, so policy enforcement still works when a device is outside the office and not connected to the VPN. The concern is what happens if that resolver becomes unreachable: will Windows automatically use the DNS servers supplied by DHCP on the current network, or will name resolution fail? We also need to account for office Active Directory lookups, captive portals, and users connecting through different network adapters.
5 Answers
An always-on VPN is another common approach. It can route company and protected traffic through the corporate or security service while allowing approved public services to go directly over the local connection. That avoids trying to use static DNS settings as a substitute for endpoint traffic controls.
Changing the adapter between static DNS and DHCP with a script can work as a short-term workaround, especially when users move between a controlled office network and home networks. However, it becomes a maintenance burden and is easy for users or adapters to get out of sync. It is usually better to fix the network design or deploy an endpoint agent that detects the connection automatically.
No—once DNS is manually configured on a network adapter, Windows ignores the DNS servers received from DHCP. If the static resolver is unavailable, Windows will only try other DNS addresses that were manually configured; it will not switch back to DHCP. At minimum, configure two reliable resolvers, but be careful because static public DNS can interfere with captive portals and internal Active Directory resolution. A roaming DNS or security agent that adapts to the current network is generally a better fit, although it needs thorough testing.
SASE or ZTNA solutions are worth evaluating for this use case. Their agents can enforce filtering, inspection, and access policies even when a user is working remotely, while still allowing the device to use the local network’s DHCP DNS when appropriate. This is usually more manageable than maintaining static DNS settings across Wi-Fi, Ethernet, docking stations, and adapters.
If you do use static DNS, configure multiple managed resolvers rather than expecting DHCP fallback. Also verify how internal names are resolved: systems joined to Active Directory generally need access to DNS servers that can resolve the AD records. A cloud resolver can work only if it is integrated with or can forward those internal zones. Remember that DNS settings are applied per network interface, so every adapter users may connect through has to be handled.
That matches what our testing showed. We tried a roaming agent, but it has been inconsistent, so we’re still evaluating alternatives.