1
Diagnostic step 1
On the client, run ipconfig /all immediately after VPN connect and capture the full output; confirm whether DNS servers are the VPN-provided ones and whether the Connection-specific DNS Suffix is populated.
FULL AI ANALYSIS
Windows 11 VPN connects but internal hostnames don't resolve because client DNS suffix isn't applied
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
The VPN is successfully assigning DNS servers, but the connection-specific DNS suffix is not being applied to the virtual adapter in split-tunnel mode. Windows uses adapter DNS suffixes and search lists to resolve unqualified names; absence of the suffix explains why FQDNs work but short names do not. The fact that full-tunnel mode applies the suffix indicates the server can push configuration, but client/adapter settings or VPN client behavior during split-tunnel are preventing suffix application.
Possible causes
Group Policy DNS suffix settings not applied to virtual adapters or overridden by client-side VPN client configuration.
85%VPN server not pushing DNS suffix to the client in split-tunnel mode or client ignoring the pushed suffix.
75%Windows 11 network profile heuristics or adapter metric causing the primary DNS search list to be that of another interface, preventing suffix usage for VPN-resolved names.
70%Third-party VPN client or security software sanitizes DNS settings on connection (intentionally for privacy or policy).
30%Suggested fixes
2
Diagnostic step 2
Compare behavior between native Windows IKEv2 and any vendor VPN client (if both available). If the native client applies the suffix but vendor client does not, raise with the VPN vendor.
3
Diagnostic step 3
Temporarily enable full-tunnel VPN for one client to show the expected suffix being applied; capture ipconfig /all and compare with split-tunnel session to prove the difference to network/security team.
4
Diagnostic step 4
If Group Policy should enforce the search suffix, verify the 'DNS Suffix Search List' policy and 'Primary DNS Suffix' are targeted to the machine and that gpresult /h output shows the policy applied to the VPN-adapter context. Use netsh interface ipv4 show config to inspect adapter-level settings.
5
Diagnostic step 5
As a reversible workaround, create a short script that adds the connection-specific DNS suffix via netsh when the VPN connects (netsh interface ipv4 set dns, netsh interface ipv4 set dnssuffix) and unregisters on disconnect; escalate to corporate IT if this is not allowed or if a systemic server-side change is required.