You can inspect Windows’ built-in DNS Client cache with PowerShell and compare suspicious answers with a trusted DNS view—without installing a separate detection tool. A mismatch is a lead to investigate, not proof of poisoning: split-horizon DNS, policy, caching, and routine record changes can also produce different answers.
What a Windows DNS cache check can tell you
Windows checks its local DNS Client cache before querying a DNS server. The cache can contain resource records from earlier DNS responses and mappings loaded from the Hosts file when the DNS Client service starts; records are subject to their time to live (TTL). Microsoft describes this behavior in DNS Queries and Lookups in Windows and Windows Server.
As an Amazon Associate I earn from qualifying purchases.
A cache inspection shows what the client currently has available for a name. By itself, it does not establish how that entry arrived, whether it was malicious, or whether the answer is still correct. Treat it as one piece of incident evidence, alongside a separately obtained comparison and, when available, resolver-side telemetry.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInspect the cache with built-in PowerShell
Run PowerShell and query the DNS Client cache with Get-DnsClientCache, a cmdlet documented in Microsoft’s DnsClient PowerShell module reference. Review the returned name, record type, data and TTL where available. To focus on one name, filter the output, for example:
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
Get-DnsClientCache | Where-Object Entry -eq 'example.com'The exact properties shown can depend on the record and command output. Preserve the complete relevant output rather than relying only on a filtered view, and note the time of collection and the configured DNS resolver. Capture the name and time of the unexpected result as well; cache contents can change as records expire or new responses arrive.
Compare the answer without mistaking a difference for an attack
- Record the client-side observation. Note the queried name, record type, cached data, TTL, collection time, and configured resolver.
- Obtain an independent comparison. Resolve the same name and record type through a trusted DNS path appropriate to your organization. Record which resolver supplied that answer and when it was obtained.
- Interpret the difference in context. A differing result warrants investigation, but can also reflect split-horizon DNS, policy, cache timing, or an ordinary record change. Check what answers are expected for that client, network, and time before escalating as suspected poisoning.
- Preserve evidence before changing state. Save the cache output and comparison details before clearing the cache or restarting services. Document any subsequent changes and their times.
For each observation, keep the queried name, record type, answer, TTL, timestamp, resolver identity, and evidence source together. A proposed comparison workflow is useful triage, not a validated standalone detection algorithm: the cited Windows documentation explains cache behavior and available commands, but does not establish a complete poisoning-detection method.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
When server-side DNS evidence is needed
A client cache check cannot show the full query and response history at the DNS server. If you administer Windows Server DNS and need more context, Microsoft documents audit, analytic, and packet-level diagnostic logging in Enable DNS Logging and Diagnostics in Windows Server. These are separate server-side collection options, not features of a client-only cache check.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Audit events cover DNS Server configuration and zone changes. Microsoft lists event 515 for record creation and event 516 for record deletion. Those events do not prove that a forged recursive response reached a Windows client.
- Analytic logging provides server activity telemetry and is not enabled by default. Microsoft warns that at 100,000 queries per second on modern hardware, enabling it can cause about 5% performance degradation; the documentation reports no apparent impact at 50,000 queries per second or lower. These are Microsoft’s examples for server analytic logging, not endpoint-detector benchmarks or guarantees.
- Packet-level diagnostics can collect DNS traffic, but collection scope, log sizing, storage, and performance need consideration. Keep collection bounded and monitor its operational impact.
DNS event data also needs careful interpretation. Microsoft Defender’s DNS normalization schema and DNS event collection guidance explains that DNS uses UDP in many flows and request and response segments may not be directly linked in collected data. The response to the client is especially useful because it can contain the queried domain, lookup result, and client IP. Logging several segments can create duplicate records, so filter or normalize before interpreting event counts.
Rank #3
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
Cache clearing is recovery or troubleshooting, not detection
Microsoft documents Clear-DnsClientCache in the DnsClient module reference. Clearing can be useful for troubleshooting or for a controlled recheck, but it does not establish that poisoning occurred and does not prevent a bad answer from being obtained again. Preserve the cache evidence first, then record when the cache was cleared and what happened on the next resolution.
How DNSSEC and encrypted DNS fit
A cache monitor, DNSSEC, and encrypted DNS serve different purposes. NIST’s Secure Domain Name System (DNS) Deployment Guide, SP 800-81r3, published March 19, 2026, covers DNSSEC’s role in DNS information integrity and authenticity, and recursive DNS confidentiality for client queries. Encrypted DNS protects query confidentiality; encryption alone does not authenticate an answer. Local cache inspection can complement these protections, but is not a substitute for DNSSEC validation or a secure resolver configuration.
Quick Recap
Rank #4
- Large Data Storage Capacity: Flash Drive with 128GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer
- Easy to use: The thumb drive is plug and play without any software installation; Supports Windows 7/8/10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also compatible with USB 2.0 and 1.1 ports; Storage is fast, safe and stable
- Wide Compatibility: USB flash drive support TV, desktop, notebook computer, car, audio and other device; It is your great data storage and transfer companion with traveling and working
- Retractable Desgin: The usb drive's retractable design can effectively protect the USB interface; The capless design can avoid losing of cap; Weight: 7g, Size: 2.6 × 0.8 × 0.4 inch. Portable to take your digital world anywhere
- What You Get: 1 x 128GB USB Flash Drive Thumb Drive, All of usb drives have been rigorously tested and formatted before leaving the factory; The default format of the USB stick is exFAT
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
