diff --git a/service/windns/windns.go b/service/windns/windns.go
index ae2897c0..f31c03f4 100644
--- a/service/windns/windns.go
+++ b/service/windns/windns.go
@@ -238,3 +238,51 @@ ForEach ($ns in $toRemove){
 		log.Errorf("ERROR removing nrpt rules: %v", err)
 	}
 }
+
+func IsNrptPoliciesEffective() bool {
+	script := fmt.Sprintf(`Add-DnsClientNrptRule -Namespace ".ziti.test" -NameServers "100.64.0.1" -Comment "Added by ziti-tunnel" -DisplayName "ziti-tunnel:.ziti.test"
+	Get-DnsClientNrptPolicy -Effective | Select-Object Namespace -Unique | Where-Object Namespace -Eq ".ziti.test"`)
+	log.Debugf("checking the nrpt policies with: %s", script)
+
+	cmd := exec.Command("powershell", "-Command", script)
+	cmd.Stderr = os.Stdout
+	output := new(bytes.Buffer)
+	cmd.Stdout = output
+
+	err := cmd.Run()
+	if err != nil {
+		log.Errorf("ERROR removing all nrpt rules: %v", err)
+	}
+
+	policyFound := false
+	for {
+		l, err := output.ReadString('\n')
+		policyOut := strings.Trim(l, "\r\n")
+		if err != nil {
+			break
+		}
+
+		if strings.Compare(policyOut, ".ziti.test") == 0 {
+			policyFound = true
+			log.Debug("The nrpt policies are effective in this client")
+			removeSingleNrtpRule(".ziti.test")
+			break
+		}
+	}
+	return policyFound
+}
+
+func removeSingleNrtpRule(nrptRule string) {
+	script := fmt.Sprintf(`Get-DnsClientNrptRule | where Namespace -eq "%s" | Remove-DnsClientNrptRule -Force -ErrorAction SilentlyContinue`, nrptRule)
+	log.Debugf("Removing the nrpt rule with: %s", script)
+
+	cmd := exec.Command("powershell", "-Command", script)
+	cmd.Stderr = os.Stdout
+	output := new(bytes.Buffer)
+	cmd.Stdout = output
+
+	err := cmd.Run()
+	if err != nil {
+		log.Errorf("ERROR removing the nrpt rules: %v", err)
+	}
+}
diff --git a/service/ziti-tunnel/service/state.go b/service/ziti-tunnel/service/state.go
index aa625adb..ce0cf91c 100644
--- a/service/ziti-tunnel/service/state.go
+++ b/service/ziti-tunnel/service/state.go
@@ -20,25 +20,26 @@ package service
 import (
 	"bufio"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"github.com/openziti/desktop-edge-win/service/cziti"
+	"github.com/openziti/desktop-edge-win/service/windns"
+	"github.com/openziti/desktop-edge-win/service/ziti-tunnel/config"
+	"github.com/openziti/desktop-edge-win/service/ziti-tunnel/constants"
+	"github.com/openziti/desktop-edge-win/service/ziti-tunnel/dto"
+	idcfg "github.com/openziti/sdk-golang/ziti/config"
 	"golang.org/x/sys/windows"
+	"golang.org/x/sys/windows/registry"
+	"golang.zx2c4.com/wireguard/tun"
+	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 	"io"
 	"io/ioutil"
 	"net"
 	"os"
 	"path"
+	"strconv"
 	"strings"
 	"time"
-	"errors"
-	"strconv"
-	"github.com/openziti/desktop-edge-win/service/cziti"
-	"github.com/openziti/desktop-edge-win/service/ziti-tunnel/config"
-	"github.com/openziti/desktop-edge-win/service/ziti-tunnel/constants"
-	"github.com/openziti/desktop-edge-win/service/ziti-tunnel/dto"
-	idcfg "github.com/openziti/sdk-golang/ziti/config"
-	"golang.org/x/sys/windows/registry"
-	"golang.zx2c4.com/wireguard/tun"
-	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 )
 
 type RuntimeState struct {
@@ -107,7 +108,6 @@ func backupConfig() (string, error) {
 	return backup, err
 }
 
-
 func (t *RuntimeState) ToStatus(onlyInitialized bool) dto.TunnelStatus {
 	var uptime int64
 
@@ -223,7 +223,8 @@ func (t *RuntimeState) CreateTun(ipv4 string, ipv4mask int, applyDns bool) (net.
 	}
 	log.Info("routing applied")
 
-	if applyDns {
+	zitiPoliciesEffective := windns.IsNrptPoliciesEffective()
+	if applyDns || !zitiPoliciesEffective {
 		//for windows 10+, could 'domains' be able to replace NRPT? dunno - didn't test it
 		luid.SetDNS(windows.AF_INET, []net.IP{ip}, nil)
 	}
@@ -428,7 +429,6 @@ func UpdateRuntimeStateIpv4(ip string, ipv4Mask int, addDns string) error {
 	}
 
 	rts.SaveState()
-	
 
 	return nil
 }