dns not resolving internal hostnames over vpn"

TL;DR

Confirm the VPN client is using the corporate DNS servers (nslookup will show which server answered), then check the DNS suffix search list includes the internal domain. If the home router is answering, DNS is leaking outside the tunnel and the client must be set to force DNS through the tunnel.

The error

nslookup intranet: server can't find intranet: NXDOMAIN (while on VPN)

Steps

1. Run nslookup internalhostname and note which server answered. Expected: the corporate DNS server. If the home router (192.168.x.1) answered, DNS is leaking.
2. Check the VPN client's DNS settings: it must push the corporate DNS servers on connect. Expected: corporate servers listed first in the adapter settings.
3. Check the DNS suffix search list includes the internal domain (e.g. corp.example.com). Expected: present. Without it, short names like "intranet" never resolve.
4. Test the FQDN: nslookup intranet.corp.example.com. Expected: resolves. If FQDN works but short name does not, it is purely a suffix issue.
5. If DNS still leaks, enable "force all DNS through tunnel" (or the client's equivalent) and reconnect. Expected: corporate DNS answers everything. Some clients need this explicitly.

When to use

• Internal names fail over VPN, IPs work
• Short names fail but FQDNs work

When not to use

• Nothing resolves, internal or external (broader DNS/network issue)
• VPN not connected

Compatibility

• Any VPN client; Windows/macOS DNS settings

Variants

Split-DNS configured intentionally

Some orgs resolve only corp domains internally; confirm the intended behavior before "fixing" it.

Works for some users only

Compare client versions and profiles; the DNS push settings differ.

Why it happens

Name resolution follows the configured DNS servers and suffix list, not the tunnel. The tunnel carries packets, but if the client asks the wrong server, internal names do not exist as far as the client knows.

Edge cases

• Browsers with secure DNS (DoH) bypass the VPN DNS entirely; disable DoH on managed devices or allowlist the behavior.
• ipconfig /flushdns after fixing settings to clear stale negative entries.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ccNAtH3a0jBYhR7RA6G71w