title: Why don't NRPT rules affect DNS queries on my Windows 10 box?
body: <p>I have some network services available on my home LAN (subnet 10.88.0.0/24), with internal DNS on that LAN (provided by the router, 10.88.0.1) at a domain suffix like <code>my.lan</code>. On the local network I can access these services via IP or domain name.</p>
  
  <p>I am connecting to that LAN remotely via an OpenVPN server. I can access all the services via IP over OpenVPN. OpenVPN is setup to push a DNS resolution zone for <code>my.lan</code> that should use the router as a DNS provider for this domain (OpenVPN server options: <code>push "dhcp-option DNS 10.88.0.1"</code>; <code>push "dhcp-option DOMAIN my.lan"</code>).</p>
  
  <p>This is causing a NRTP rule to be installed on the system that looks like this:</p>
  
  <pre><code>PS C:\WINDOWS\system32&gt; Get-DnsClientNrptPolicy
  
  
  Namespace                        : .my.lan
  QueryPolicy                      :
  SecureNameQueryFallback          :
  DirectAccessIPsecCARestriction   :
  DirectAccessProxyName            :
  DirectAccessDnsServers           :
  DirectAccessEnabled              :
  DirectAccessProxyType            : NoProxy
  DirectAccessQueryIPsecEncryption :
  DirectAccessQueryIPsecRequired   : False
  NameServers                      : 10.88.0.1
  DnsSecIPsecCARestriction         :
  DnsSecQueryIPsecEncryption       :
  DnsSecQueryIPsecRequired         : False
  DnsSecValidationRequired         : False
  NameEncoding                     : Utf8WithoutMapping
  </code></pre>
  
  <p>However, this rule doesn't seem to get used for actual DNS client queries. Domains like <code>www.my.lan</code> still get resolved (or rather fail to resolve) at the DNS given by my regular network interface, either my ethernet card, or wifi, depending on how I'm connected at the time (nslookup + WireShark confirm this). I am able to resolve names on the LAN with nslookup by providing the DNS server: <code>nslookup www.my.lan 10.88.0.1</code> resolves correctly over the VPN connection. I have also attempted to enable NRPT by setting <code>QueryPolicy</code> to <code>QueryBoth</code>:</p>
  
  <pre><code>PS C:\WINDOWS\system32&gt; Set-DnsClientNrptGlobal -QueryPolicy "QueryBoth" -PassThru
  
  EnableDAForAllNetworks QueryPolicy SecureNameQueryFallback
  ---------------------- ----------- -----------------------
  Disable                QueryBoth   Disable
  </code></pre>
  
  <p>This appears to have no effect (either Disable or QueryBoth). The other parameters on this object seem to be for DirectAccess clients, and a fallback option for DNS queries that should be 'secure', do they need to be active as well?</p>
  
  <p>What is the proper way to cause the Name Resolution Policy Table to affect DNS queries?</p>