Windows Event ID 264 – DNS Client: DNS Query Response Timeout

Start by testing basic connectivity to your configured DNS servers to identify network-level issues.

1. Open Command Prompt as Administrator
2. Check current DNS configuration:
   

   ipconfig /all

3. Test DNS server connectivity:
   

   Test-NetConnection -ComputerName 8.8.8.8 -Port 53
   Test-NetConnection -ComputerName 1.1.1.1 -Port 53

4. Perform manual DNS lookups:
   

   nslookup google.com 8.8.8.8
   nslookup microsoft.com 1.1.1.1

5. Check DNS resolution timing:
   

   Resolve-DnsName -Name google.com -Server 8.8.8.8 -Type A

If connectivity tests fail, investigate network routing, firewall rules, or contact your network administrator about DNS server availability.

DNS cache corruption can cause repeated timeout events. Reset the DNS resolver cache and network stack components.

1. Open Command Prompt as Administrator
2. Flush DNS resolver cache:
   

   ipconfig /flushdns

3. Reset Winsock catalog:
   

   netsh winsock reset

4. Reset TCP/IP stack:
   

   netsh int ip reset

5. Restart DNS Client service:
   

   Restart-Service -Name Dnscache -Force

6. Verify DNS cache is empty:
   

   ipconfig /displaydns

7. Restart the computer to complete network stack reset

Examine DNS-specific event logs and configure backup DNS servers to improve resolution reliability.

1. Open Event Viewer → Applications and Services Logs → Microsoft → Windows → DNS Client Events → Operational
2. Filter for Event ID 264 events:
   

   Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-DNS-Client/Operational'; Id=264} -MaxEvents 50 | Format-Table TimeCreated, Message -Wrap

3. Identify problematic DNS servers from event details
4. Configure alternative DNS servers via PowerShell:
   

   $adapter = Get-NetAdapter -Name "Ethernet"
   Set-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex -ServerAddresses "8.8.8.8","1.1.1.1","208.67.222.222"

5. Verify new DNS configuration:
   

   Get-DnsClientServerAddress -InterfaceAlias "Ethernet"

6. Test resolution with new servers:
   

   Test-DnsServer -IPAddress "8.8.8.8" -ZoneName "microsoft.com"

Modify DNS client timeout parameters to accommodate slower network conditions or distant DNS servers.

1. Open Registry Editor as Administrator
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
3. Create or modify timeout values (DWORD, decimal):
   • MaxCacheTtl = 86400 (24 hours)
   • MaxNegativeCacheTtl = 300 (5 minutes)
   • NetFailureCacheTime = 30 (30 seconds)
4. Configure DNS query timeout via PowerShell:
   

   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" -Name "QueryTimeout" -Value 10 -Type DWord

5. Set DNS server retry attempts:
   

   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" -Name "ServerPriorityTimeLimit" -Value 15 -Type DWord

6. Restart DNS Client service:
   

   Restart-Service -Name Dnscache

Deploy automated monitoring to track DNS performance and identify timeout patterns proactively.

1. Create DNS monitoring PowerShell script:
   

   # DNS-Monitor.ps1
   $dnsServers = @("8.8.8.8", "1.1.1.1", "208.67.222.222")
   $testDomains = @("microsoft.com", "google.com", "github.com")
   
   foreach ($server in $dnsServers) {
       foreach ($domain in $testDomains) {
           $result = Measure-Command { Resolve-DnsName -Name $domain -Server $server -ErrorAction SilentlyContinue }
           Write-Output "$server - $domain: $($result.TotalMilliseconds)ms"
       }
   }

2. Schedule monitoring task:
   

   $action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\DNS-Monitor.ps1"
   $trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 15) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
   Register-ScheduledTask -TaskName "DNS-Monitor" -Action $action -Trigger $trigger

3. Create Event ID 264 alert script:
   

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=264; StartTime=(Get-Date).AddHours(-1)} | 
   ForEach-Object { Send-MailMessage -To "admin@company.com" -Subject "DNS Timeout Alert" -Body $_.Message }

4. Enable DNS debug logging:
   

   wevtutil sl Microsoft-Windows-DNS-Client/Operational /e:true