---
title: 'Tutorial: Configure DNS Settings in Access Server'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--configure-dns-settings/
product: Access Server Docs
description: Configure DNS settings in OpenVPN Access Server, including DNS proxy modes, DNS servers, split DNS (resolution zones), and how DNS interacts with domain-based routing.
keywords: Domain Name System DNS
---

# Tutorial: Configure DNS Settings in Access Server

## Overview

The Domain Name System (DNS) translates domain names into IP addresses so clients can connect to resources. In Access Server, [DNS settings](https://openvpn.net/as-docs/v3/dns.md) determine how connected VPN clients resolve domain names and which DNS servers they use.

Access Server can:

- Use the same DNS servers as the host system.
- Push specific DNS servers to VPN clients.
- Leave client DNS settings unchanged.

Access Server also supports advanced configurations, such as default domain suffix, split DNS (resolution zones), and integrates with [domain routing](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-in-access-server.md), where DNS responses control how traffic is routed through the VPN.

## Prerequisites

- Access Server installed and running
- Access to the Admin Web UI

## Step 1: Configure the DNS proxy mode

1. Sign in to the Admin Web UI.
2. Select **Access Controls → Internet Access and DNS**.
3. Under **DNS Server Proxy**, select one of the following:
   - **Auto** (Default) — Clients with domain routing rules have their DNS queries proxied through Access Server. All other clients query the specified DNS servers directly.
   - **Always Proxy** — Access Server proxies DNS for every client and forwards queries to the DNS servers you configure. (Some Access Server versions label this as **Always**.)
   - **Off** — Access Server doesn't alter client DNS behavior. This disables domain-based access rules. (Some Access Server versions label this as **Never**.)
4. Click **Save** and **Restart**.

> **Note**
>
> In Access Server 3.1.0 and newer, DNS proxy mode is set to **Auto** by default. In some upgrade scenarios, it may remain set to **Off**. DNS proxy mode can only be set to **Off** when using split tunnel.

## Step 2: Configure DNS servers

Access Server 3.2.2 separates DNS server configuration into two distinct settings, now visible as separate fields in the Admin Web UI:

### Upstream DNS

Upstream DNS is the DNS server Access Server's DNS proxy uses to resolve queries on behalf of clients with active domain routing rules.

1. Under **Upstream DNS**, select:
   - **Autodetected** (default) — Access Server uses the DNS server detected from the server's operating system. The detected IP address is shown below the field.
   - **Custom** — Enter a specific DNS server IP address.
2. Select **Save**.

To configure via CLI:

1. Connect to the console and get root privileges.
2. Run:

   ```
   sacli --key "dnsproxy.upstream_dns" --value "<DNS_SERVER_IP>" ConfigPut
   sacli start
   ```
3. To reset to autodetected:

   ```
   sacli --key "dnsproxy.upstream_dns" --value "auto" ConfigPut
   sacli start
   ```

### Client DNS

Client DNS is the DNS server that Access Server advertises to VPN clients that do not have domain routing rules active. These clients resolve DNS queries directly against this server rather than through the DNS proxy.

1. Under **Client DNS**, select:
   - **Autodetected** (default) — Uses the DNS server detected from the server's operating system.
   - **Custom** — Enter up to three DNS server IP addresses.
2. Select **Save**.

> **Note**
>
> Prior to Access Server 3.2.2, the DNS proxy used the same servers as Client DNS for its upstream resolver. As of 3.2.2, these are controlled separately. If you upgraded from an earlier version and notice changes in DNS resolution behavior, verify both Upstream DNS and Client DNS settings.

> **Tip**
>
> For the full list of DNS proxy configuration options including listening port and timeout settings, see [Tutorial: Configure Domain Routing Settings Using the Access Server CLI](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-settings-via-cli.md).

## Step 3: Configure default domain suffix (optional)

1. In **Default Domain Suffix**, enter a domain (for example, `company.local`).
2. Click **Save** and **Restart**.

> **Note**
>
> **What this does**
>
> This setting helps Windows clients resolve short hostnames to fully qualified domain names (FQDNs).
>
> For example, if you have `openvpn.com` as the domain suffix, when you access `awspc3`, this resolves to `awspc3.openvpn.com`.

## Step 4: Configure DNS resolution zones (split DNS)

> **Important**
>
> Split DNS requires enabling split tunnel, and for Access Server 3.1.0 and newer, these conditions need to be met:
>
> - DNS Server Proxy is set to **Auto**, and
> - No domain routing rules are applied to the user.
>
> If the user has domain routing rules (at the global, group, or user level), Access Server doesn't push DNS zones to the client.

1. In **DNS Resolution Zones**, click **Add another DNS resolution zone**.
2. Enter the domain (for example, `internal.company.com`).
3. Click **Save** and **Restart**.

> **Note**
>
> **What this does**
>
> Split DNS ensures that only the specified domains are resolved using the DNS servers configured in the **DNS Servers** section, while all other domains use the default DNS behavior.

> **Tip**
>
> Some clients (such as Windows) may only respect the first domain listed.

## Step 5: Understand DNS behavior with domain routing

Access Server 3.1.0 introduces built-in [domain-based routing](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-in-access-server.md) using a DNS engine. This allows you to route traffic by domain name without redirecting all traffic or maintaining large lists of IP addresses for content delivery networks (CDNs).

Here's how it works:

- VPN clients use the Access Server's internal DNS engine.
- Specific domains are resolved to private IPs reserved for routing through the VPN tunnel.
- Access Server NATs traffic destined for the actual destination using `nftables`.
- You can define domains to route (or exclude from routing) on a global, group, or per-user basis.

This allows you to route traffic by domain name without requiring full-tunnel routing.

> **Tip**
>
> **Example**
>
> Route traffic for a SaaS application (such as **salesforce.com**) through the VPN while allowing other traffic to go directly to the internet.

> **Note**
>
> Changes to DNS or domain routing settings may require users to reconnect.

## Next steps

For configuring domain-based routing rules and advanced DNS proxy behavior, see:

- [Tutorial: Configure Domain Routing in Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-in-access-server.md)
- [Tutorial: Step-by-Step Examples for Split Tunnel and Role-Based Access Using Domain Routing](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-split-tunnel-and-role-based-access.md)
- [Tutorial: Configure Domain Routing Settings Using the Access Server CLI](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-settings-via-cli.md)
- [Tutorial: Configure Domain Routing Rules in Access Server from the Command-Line Interface](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-via-cli.md)

---

Prev: [Tutorial: Step-by-Step Examples for Configuring Full and Split Tunneling in Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--extended-full-and-split-tunnel-configurations.md)
Next: [Tutorial: Configure Domain Routing in Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--domain-routing-in-access-server.md)
Index: https://openvpn.net/as-docs/llms.txt