Log Dejargonizer

Windows System Log · Event 1014

Event 1014: A DNS lookup timed out

Windows asked for the address behind a name and none of the DNS servers answered in time. Usually a brief network wobble. When it repeats, the DNS settings or the connection itself are the problem — not the website you were trying to reach.

Also written as Event ID 1014DNS Client Events 1014dns timeout event

What it means for you

On a personal computer

Your PC tried to look up a website address and got no answer quickly enough. If pages load fine, ignore it — this happens whenever the connection stutters. If sites are slow to start loading or fail intermittently, this is probably why, and changing your DNS servers usually fixes it.

For an analyst

On laptops it is frequently a VPN or a wireless roam rather than a DNS fault. On servers it points at a domain controller not answering, which cascades into authentication problems that look unrelated. Read the name being resolved — internal names failing means a different investigation from external ones.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Name resolution for the name updates.example.invalid timed out after none of the configured DNS servers responded.

The fields that decide it

Everything else in the log line is context.

Name
The hostname that failed to resolve. The most useful field by far.
  • An internal or domain namePoints at your own DNS servers or domain controllers, not the internet.
  • An external websiteUsually a transient connectivity problem or an unreachable upstream resolver.
  • A telemetry or update endpointVery common background noise, and rarely worth chasing.
DNS servers used
The resolvers that were tried and did not answer. Compare against what the machine should be using.
Timing pattern
Not a field, but bursts at wake-from-sleep or at connection changes are characteristic of roaming rather than a DNS fault.

Ordinary reasons this happens

Most of the time it is one of these.

  • A brief internet or wireless interruption.
  • Waking from sleep before the network is ready, which produces a burst of these at every wake.
  • Roaming between wireless access points.
  • A VPN connecting or disconnecting and changing which resolvers apply.
  • Background telemetry and update services resolving names while the connection is down.
  • A DNS server briefly overloaded or restarting.

When it is not ordinary

Malware resolving command and control infrastructure that no longer exists.

What gives it awayRepeated failures for random-looking or unfamiliar domain names from a machine that is otherwise fine.

ATT&CK T1568.002

DNS settings changed to a resolver under someone else's control.

What gives it awayThe DNS servers listed in the event are not the ones you configured.

ATT&CK T1584.002

What to do next

  1. Read the name that failed. Internal versus external splits the investigation immediately.
  2. Check whether the entries cluster at wake-from-sleep or network changes — that is normal behaviour, not a fault.
  3. Confirm which DNS servers the machine is actually using and that they are the ones you expect.
  4. Test resolution directly with nslookup or Resolve-DnsName against each configured server.
  5. On a laptop, check whether a VPN client is changing the resolvers.
  6. If the names being resolved are unfamiliar and random-looking, treat that as a separate question from the timeout itself.

Queries to run

powershell 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1014} -MaxEvents 50 | Select-Object TimeCreated, Message | Format-List
powershell Which resolvers each adapter is actually using. Often not what people expect once a VPN is involved. 
Get-DnsClientServerAddress -AddressFamily IPv4 | Select-Object InterfaceAlias, ServerAddresses
powershell Test one server directly rather than whichever the machine happens to pick. 
Resolve-DnsName example.com -Server 192.0.2.10 -DnsOnly
powershell Failures by hour of day. Clustering points at a scheduled event rather than a general fault. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1014; StartTime=(Get-Date).AddDays(-7)} | Group-Object { $_.TimeCreated.Hour } | Select-Object Name, Count | Sort-Object Name

Common questions

Should I worry about Event 1014?

Not if the internet works. It appears whenever a lookup does not get an answer quickly enough, which happens on any connection that briefly stutters or on any laptop that sleeps and wakes. It matters when it is frequent and sites are actually failing or slow to start loading.

How do I fix repeated DNS timeouts?

Change the DNS servers your machine uses to something reliable — your router's own resolver is often the weak link on a home network. On a work machine, check whether a VPN client is redirecting resolution. Flushing the cache with `ipconfig /flushdns` clears bad entries but does not fix an unreliable server.

Why do I get a burst of Event 1014 every time my computer wakes up?

Because Windows resumes background services before the network is fully connected, so their lookups fail for a few seconds. It is normal, self-correcting, and not worth chasing. Bursts tied to wake or to switching wireless networks are the signature of this rather than of a DNS problem.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026