I've had 11,505 resolved checks to that domain in the last 24 hours! This is apparently Microsoft (Windows 10 version 20H2), checking to see how it should display the network icon in the system tray. Trying to see if I'm online and in the last 24 hours it has checked 11,505 times. This seems excessive. Is there any advantage to blocking it? Any way to control it?
This is typical for most routers to ping Microsoft servers for network information
You can safely either blacklist this or simply login to your router and remove the entry from network monitoring. Mine wasn't enabled and yet it was still sending out packets - thanks to NextDNS I tracked it down to the router settings hidden inside the NVRAM.
My router model is ASUS, so settings labels mentioned below might vary on other models.
- First, open your router’s web UI (default is http://192.168.1.1).
- On the left-hand side, click on Administration
- Click tab System
- Search for Network Monitoring option in the list
- Select DNS Query checkbox, two input fields are going to get displayed:
- Resolved Target
- Respond IP
- Clear the values of both fields above
- Click button Apply
- Make sure DNS Query checkbox is not selected
After the change has been applied, you can observe that there are no new queries for dns.msftncsi.com
You might have to perform this task again if the router receives an update