WSANO_RECOVERY 0X00002AFB: DNS Lookup Fails After Network Switch

You're in the middle of something—maybe a remote desktop session or a build that pulls from a private registry—and suddenly your app throws WSANO_RECOVERY (0X00002AFB). The message says "a nonrecoverable error occurred during a database lookup." That's Windows telling you the DNS query itself failed in a way that can't be retried. Not a timeout, not a "server not found." Something in the resolver's state is broken.

What's actually happening here is that the Winsock catalog or the DNS client cache has gotten into a state where it can't even send the query properly. This almost always shows up right after you switch networks—laptop wakes from sleep, you move from office Wi-Fi to a tethered phone, or you plug into a new VLAN. The adapter gets a new IP, but the network stack keeps stale state.

The good news: you don't need to reinstall Windows or even touch the registry. In most cases the fix is a two-command sequence that resets the Winsock catalog and flushes the DNS resolver cache. Let's start there because it's the most common cause and the fastest fix.

Cause 1: Stale Winsock Catalog or DNS Cache

The Winsock catalog is a list of service providers that handle network I/O. If an antivirus, a VPN client, or even a failed update left a bogus entry, every DNS query goes through a provider that chokes and returns WSANO_RECOVERY. A corrupt DNS cache can produce the same error because the resolver tries to use a cached record that's no longer valid and fails hard.

I've seen this exact error after a Cisco AnyConnect session dropped abruptly, and also after a Windows update that changed the network stack. The trigger is often a suspend/resume cycle where the network driver reloads but the Winsock providers don't.

The fix

Open a command prompt as Administrator. Don't skip the admin part—the reset won't work otherwise. Then run these in order:

netsh winsock reset
netsh int ip reset
ipconfig /flushdns

The first command rebuilds the Winsock catalog from scratch. The second resets the TCP/IP stack, which clears any leftover routing or adapter state. The third wipes the DNS cache. After these, reboot. Yes, you have to reboot—the Winsock reset doesn't take full effect until the system restarts.

The reason this works: netsh winsock reset rewrites the catalog entries under HKLM\SYSTEM\CurrentControlSet\Services\WinSock2 to their default state. Any third-party provider that was causing the nonrecoverable error gets removed. The IP reset does the same for TCP/IP parameters, and flushing DNS removes any poisoned entries.

If that doesn't do it, move to the next suspect.

Cause 2: Expired or Misconfigured DHCP Lease

Here's a scenario: you're on a corporate network that hands out IP addresses with a short lease—say 15 minutes. Your laptop slept for an hour. When it wakes, the network stack still thinks it has the same IP, but the DHCP server already gave that address to someone else. The adapter has an IP that's no longer valid, yet the DNS client keeps trying to use the old DNS server IP. Result: every lookup returns WSANO_RECOVERY because the resolver can't reach a valid DNS server.

You can spot this by checking if you have an IP at all—sometimes you'll see an APIPA address starting with 169.254. But other times the old IP stays visible in the UI, which makes it tricky.

The fix

Force a lease renewal:

ipconfig /release
ipconfig /renew
ipconfig /flushdns

The release command drops the current lease. The renew command asks the DHCP server for a fresh one. This clears any stale DNS server addresses that the resolver was trying to use.

If you're on a static IP—like in a data center or when you've manually configured a server—then skip the release/renew and just verify your DNS server entries. Run ipconfig /all and check that the DNS servers listed are actually reachable. A common mistake is leaving the DNS server at the old gateway's address after moving to a different subnet.

I've also run into cases where the DHCP server itself hands out a DNS server that's down. If renewing doesn't help, try setting a public DNS temporarily:

netsh interface ip set dns "Ethernet" static 8.8.8.8

Replace Ethernet with your adapter's name—check via ipconfig. If that fixes the lookup, the problem is on the DHCP side, not your machine.

Cause 3: Firewall or Security Software Blocking the Resolver

Less common but real: a third-party firewall or an antivirus with network protection is intercepting DNS queries and returning an error instead of forwarding them. The resolver sees that as a nonrecoverable failure. This often appears after a security software update, or when you install a new VPN that adds a filter driver to the network stack.

The giveaway is that the error appears consistently for all domains, not just one or two. And you might notice other network operations—like ping to an IP address—work fine. Only DNS fails.

The fix

First, test with the firewall temporarily disabled. If the lookup succeeds, you've found the culprit. Don't leave it disabled—that's not a fix, it's a diagnostic.

The real fix is to reconfigure the security software to allow svchost.exe (which hosts the DNS client service) to make outbound UDP/TCP connections on port 53. In some suites, you need to exclude the Winsock catalog from monitoring. Look for options like "network protection" or "web filtering" and add the DNS client service to the allow list.

If you're using a VPN client that installs its own network filter (like WireGuard's wintun or OpenVPN's TAP driver), try uninstalling the VPN client completely, rebooting, and then testing DNS. If that clears the error, reinstall the VPN—this time check if it has an option to not modify the Winsock catalog during install.

I've also seen this happen with certain "privacy" apps that claim to encrypt DNS. They break the standard resolver. Uninstall those or disable their DNS handling.

Quick-Reference Summary

Start with the Winsock reset—it fixes the majority of cases and takes less than a minute. If you're still seeing the error after that, move to the DHCP lease renewal. Only go down the firewall path if both of those fail, because it involves more digging and potentially reinstalling software.