NCSI Windows 10 (Internet probing over dns) does not work, specifically with SimpleDnsCrypt

SimpleDnsCrypt UI を使用し、127.0.0.1 のみを DNS サーバーとして Windows 10 の手順を再現し、その後、選択したネットワーク アダプターの DNS 設定がどのように構成されるかを追跡します。この動作をリンク先の dnscrypt-proxy issue と比較し、手動でセカンダリ DNS サーバーを追加しなくても NCSI と Microsoft アプリが動作することを確認します。

Who is the bug affecting?

Windows 10 users of SimpleDnsCrypt

I am running Windows 10 2020H2 update, version "Version 10.0.19042.746" is shown in cmd.exe when it starts up.

What is affected by this bug?

Windows 10 NSCI fails to detect network connectivity. This means that Microsoft store apps, and Microsoft apps such as office cannot connect to the internet and function properly.

When does this occur?

When 1) SimpleDnsCrypt service is running, and you have "checked" your main network adapter in the SimpleDnsCrypt UI and 2) windows dns settings for your network adapter are set to "127.0.0.1" with NO secondary set

Where does it happen?

See above. It happens on Windows 10 computers running SimpleDnsCrypt without fallback DNS provider set up.

How do we replicate the issue?

• Install SimpleDnsCrypt on Windows
• Run SimpleDnsCrypt. Turn on the service in the UI. Then click on your main network adapater, to enable SimpleDnsCrypt for your network adapter
• Go to "network connections" in Windows > right click network adapter > IPv4 > properties > make sure DNS is set to 127.0.0.1 with NO secondary dns set.
• Disable and re-enable your windows network adapter to re-trigger an NCSI check. You can do this in "network connections" > right click your adapter > disable > wait a few seconds > enable
• If you do the above, you Windows 10 NSCI will show "no internet". Microsoft apps (like Office), and Windows store apps will not be able to connect to the internet. This persists through reboots. It's just broken and confusing if you don't know how to fix this.

Workaround:

1. Go to "network connections" > right click adapter > IPv4 > properties > add a secondary DNS server, like 1.1.1.1 > hit okay to save
2. Open SimpleDnsCrypt, then "uncheck" your network adapter.
3. Disable and re-enable network adapter, and NSCI check will work now

Doing step 2, I'm not sure of the security implications of this. The SimpleDnsCrypt server seems to still get dns queries and process them, but NCSI works now.

Expected behavior (i.e. solution)

SimpleDnsCrypt should automatically work when you install it. It should set primary dns provider to 127.0.0.1 AND set a secondary DNS provider to work around the NCSI issue.

Other Comments

It took me months to find the cause of this bug. I had 2 issues actually, one with SimpleDnsCrypt, and one with another piece of software, DisableWinTracking. DisableWinTracking was blocking msftncsi from dns in the hosts file. After fixing this, I narrowed the last issue down to SimpleDnsCrypt , which is built on top of dnscrypt-proxy. Both SimpleDnsCrypt and dnscrypt-proxy have the same issue, both require a secondary DNS server to be set on windows 10.

For anyone running DisableWinTracking, make sure you edit C:\Windows\System32\drivers\etc\hosts and add # before "0.0.0.0 msftncsi.com" and "0.0.0.0 www.msftncsi.com" . And then don't forget to add a secondary DNS provider like 1.1.1.1 in your network adapter > IPv4 dns settings if you're running SimpleDnsCrypt or dnscrypt-proxy. Users of SimpleDnsCrypt actually have to go one step further than this and unclick your network adapter in the SimpleDnsCrypt interface to get windows NCSI to work. You're welcome googlers :p.

I also posted this issue to the dnscrypt-proxy project, since both projects share a very similar issue, although SimpleDnsCrypt has one more bug beyond dnscrypt-proxy (you must uncheck your network adapter in SimpleDnsCrypt UI to make Windows NSCI work, in addition to the other workarounds).
https://github.com/DNSCrypt/dnscrypt-proxy/issues/1594

keywords for googlers:
nslookup dns.msftncsi.com
www.msftncsi.com/ncsi.txt
windows 10 no internet connection