hosts file ignored, how to troubleshoot?

Question

The hosts file on Windows computers is used to bind certain name strings to specific IP addresses to override other name resolution methods.

Often, one decides to change the hosts file, and discovers that the changes refuse to take effect, or that even old entries of the hosts file are ignored thereafter. A number of "gotcha" mistakes can cause this, and it can be frustrating to figure out which one.

When faced with the problem of Windows ignoring a hosts file, what is a comprehensive troubleshoot protocol that may be followed?

---

This question has duplicates on SO, such as HOSTS file being ignored

However, these tend to deal with a specific case, and once whatever mistake the OP made is found out, the discussion is over. If you don't happen to have made the same error, such a discussion isn't very useful. So I thought it would be more helpful to have a general protocol for resolving all hosts-related issues that would cover all cases.

Answer 1

Based on my own experience and what I encountered while Googling, here are some things to try:

1. Did you check that it works correctly?

Changes to hosts should take effect immediately, but Windows caches name resolution data so for some time the old records may be used. Open a command line (Windows+R, cmd, Enter) and type:

ipconfig /flushdns

To drop the old data. To check if it works, use (assuming you have an ipv4 entry in your hosts for www.example.com, or an ipv6 entry in your hosts for ipv6.example.com):

ping -4 www.example.com -n 1
ping -6 www.example.com -n 1

And see if it uses the correct IP. If yes, your hosts file is fine and the problem is elsewhere.

Also, you can reset the NetBios cache with (open the console as an admin or it will fail):

nbtstat -R

You can check the current data in the DNS cache with:

ipconfig /displaydns | more

NB: nslookup does not look at the hosts file. See NSLOOKUP and NBLOOKUP give one IP address; PING finds another

2. Basics

• Is your hosts file named correctly? It should be hosts and not host, etc.
• Is the extension correct? It should have no extension (hosts not hosts.txt) - be careful if you have configured windows to hide known extensions, check the properties to be sure: The correct hosts file's type will show up as just "File".
• Did you follow the correct syntax? Did you accidentally prefix lines with a hash (#) which indicates comments?
• Did you take care of all variants (www.example.com and example.com - safest to just add both)?

3. Whitespace

The format for each line is IP address, then a horizontal tab (escape code \t, ASCII HT, hex 0x09) or a single space (hex 0x20), then the host name, ie. www.example.com, then finally a carriage return followed by a line feed, (escape codes \r\n, ASCII CRLF, hex 0x0d 0x0a).

Sample entries, using Unicode control pictures to indicate control characters. (Don't copy and paste these into your hosts file!)

192.0.2.1␉www.example.com␍␊
2001:db8:8:4::2␉ipv6.example.com␍␊

The individual bytes may be viewed in Notepad++ with the hex editor plugin. Notepad++ will also show special characters (View -> Show Symbol) so you can easily inspect the number and kind of whitespace characters.

If you copied and pasted hosts entries from somewhere, you may end up with multiple spaces. In theory hosts supports multiple spaces separating the two columns, but it's another thing to try if nothing else works.

To be on the safe side, make sure all lines in your hosts file either use tabs or spaces, not both.

Lastly, terminate the file with a blank line.

4. Registry Key

There is a registry key specifying the location of the hosts file. Supposedly, Windows doesn't actually support putting the hosts file in other locations, but you might want to check. The key is:

\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath

The entry should be:

%SystemRoot%\System32\drivers\etc

Or, in a Command Prompt window, type:

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters -v DataBasePath

which should display something similar to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
DataBasePath    REG_EXPAND_SZ    %SystemRoot%\System32\drivers\etc

5. Permissions

Sometimes there are issues with permissions on the file, the file attributes, and similar things. To recreate the file with default permissions:

1. Create a new text file on your desktop.
2. Copy and paste the contents of your current hosts file into this file in Notepad.
3. Save the new text file and rename it to hosts.
4. Copy (do not move) the file to your %SystemRoot%\System32\drivers\etc directory, and overwrite the old file.

Last point is important: Copying works, moving doesn't.

The local Users account must be able to read the hosts file. To make sure (in Windows 7):

1. Navigate to %SystemRoot%\System32\drivers\etc in Windows Explorer.
2. If you can't see the hosts file, ensure you can see hidden and system files.
3. Right-click on the hosts file and select Properties from the context menu.
4. In the hosts Properties window, click on the Security tab.
5. Examine the list of names in the Group or user names: box. If %COMPUTERNAME%\Users is present, click on it to view permissions.
6. If Users is not present, or is present but does not have Read permission, click Edit....
7. If Users is not present, click Add..., type Users, click Check Names, and click OK or press Enter.
8. Select Users, and ensure Read & execute is checked in the Allow column. Click OK. If a Windows Security alert box pops up, choose Yes to continue.
9. Click OK to close the hosts Properties window.
10. Go up to section 1 of this answer and follow the directions to check if it's working now.

Or, in a Command Prompt window, type:

icacls %SystemRoot%\System32\drivers\etc\hosts

which should display something like:

C:\WINDOWS\System32\drivers\etc\hosts NT AUTHORITY\SYSTEM:(F)
                                      NT AUTHORITY\SYSTEM:(I)(F)
                                      BUILTIN\Administrators:(I)(F)
                                      BUILTIN\Users:(I)(RX)
                                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                      APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)

You should see an (R) after BUILTIN\Users.

6. Encoding

The hosts file should encoded in ANSI or UTF-8 without BOM. You can do this with File -> Save As.

7. Proxies

If you have a proxy configured, it may bypass the hosts file. The solution is to not use the proxy, or configure it to not do this.

To check, go to your Internet Explorer -> Internet Options -> Connections -> LAN settings. If everything is blank and "Automatically detect settings" is checked, you aren't using a proxy.

If you rely on a proxy to access the web and therefore don't want to disable it, you can add exceptions by going to Internet Explorer -> Internet Options -> Connections -> LAN settings -> Proxy Server / Advanced. Then add your exceptions to the Exceptions text box. e.g. localhost;127.0.0.1;*.dev

8. DNS address

(This may also resolve proxy issues.)

Go to your network connections properties, then TCP/IP settings, and change the first DNS server to 127.0.0.1 (localhost). The second should probably be your actual DNS's IP.

This is not necessary for the hosts file to work, but it may help in your case if something is configured strangely.

9. .local addresses

If you are using a .local domain entry in the form of myhost.local and it gets ignored please try the following:

x.x.x.x myhost.local www.myhost.local

even if the www.myhost.local does not exist. Windows somehow does not append its workgroup or localdomain.

10. Line / count limits

(added to this answer to make it visible as it's been mentioned a few times)

Windows hosts file seems to have a line or host limit. If you have more than 150 characters on a line or more than 8 hosts entries for an IP create a new line

e.g. instead of:

1.2.3.4 host1.com host2.com host3.com host4.com host5.com host6.com host7.com host8.com host9.com 

Try this:

1.2.3.4 host1.com host2.com host3.com host4.com host5.com
1.2.3.4 host6.com host7.com host8.com host9.com
 

Answer 2

Make sure you have put the ipaddress first and then the "domain" like this:

127.0.0.1   bo.dev
127.0.0.1   www.bo.dev

Answer 3

Please add checking file permissions. I found that even though I had Local Admin rights to the computer and thus to hosts. It was not until I added local users to the hosts file permissions with Read and Read & Execute and then a ipconfig /flushdns That the hosts became active.

Answer 4

In my cases I tried Windows 7 created file: C:\Windows\System32\drivers\etc\hosts.ics.

hosts.ics:

# This file has been automatically generated for use by Microsoft Internet
# Connection Sharing. It contains the mappings of IP addresses to host names
# for the home network. Please do not make changes to the HOSTS.ICS file.
# Any changes may result in a loss of connectivity between machines on the
# local network.

As the result, Windows ignores settings in C:\Windows\System32\drivers\etc\hosts and uses it from hosts.ics.

Answer 5

I was experiencing the same issue, hosts file entries being ignored. I tried everything in this and many other threads with no luck. I figured I'd post what worked for me in case someone else comes across this.

1. Open Windows Explorer as Administrator
2. DELETE the hosts file
3. Open notepad as Administrator and create a new hosts file
4. Start from scratch and add entries.
5. Ensure the hosts file doesn't have a .txt extension

Note: simply opening the hosts file and deleting the content, verifying that it was 0kb and re-adding it did not work. I suspect a permissions issue on the file.

Answer 6

Have spent hours, probably days on this.

IBM Trusteer Endpoint Rapport security can cause this problem.

I had added mysite.com to its list of trusted sites.

I think as part of its security it prevents malware or viruses diverting you to alternative sites.

Took mysite of the list of trusted sites and it no longer checks and "corrects" my hosts file diversion.

Hope that helps somebody resolve their problem.

Answer 7

One problem missed in the discussion above is unqualified names (names that do not include a period) in the hosts file. Your network settings might kick in at that point and automatically add your own domain to the end of an unqualified domain. Consequently the name might not resolve, or worse yet, resolve to a completely different machine.

Answer 8

Make sure that you have entered the values as IP NAME, not as NAME IP.

This can happen if there is, say, only one entry in the file, and when you ignore the comment-out text.

Answer 9

Make sure that it whatever application is ignoring the hosts file is actually using Windows' DNS cache in the first place. For instance, the Chrome browser respects the hosts file, but has its own DNS cache that must be flushed separately from Windows' if the hosts file is updated.

Answer 10

Post-8.1 Windows defaults to localhost resolution within the DNS stack itself. The reason you get IPv6 is because MS implemented default address selection via RFC 3484.

You can override the preference for IPv6 via prefix policies.

Elevated PS> netsh interface ipv6 add prefixpolicy ::ffff:0:0/96 precedence=51 label=4 store=persistent

See my blog post: Defaulting Windows Loopback to IPv4

Update (04/01/2022): I originally posted "set" but you need to "add" the prefix policy first.

Answer 11

In windows, make sure HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath is pointed to the directory of the hosts file.

Answer 12

On my case the issue was that I was copying a hosts file from an encrypted directory and overriding the etc/hosts with that. I had to look at properties and uncheck the "encrypt file" checkbox.

Answer 13

My hosts file is ignored until I have a network connection on my (Windows 7) laptop. Once I connect to a network, everything works as expected. Obviously, without a network I can't ping hosts etc. but I still expected Windows to get their IP addresses from the hosts file. It doesn't. Even after disconnecting it still looks up addresses OK, but between restarting the computer and first connecting to a network, it ignores the hosts file.

(Incidentally, tabs, spaces and no carriage returns are all irrelevant as far as I can tell).