The Hosts File Explained: What It Is, Where It Lives, and Its Pros and Cons

The hosts file is a plain text list of names and IP addresses that lives on your own computer. Your computer checks it before it asks DNS, so any line in it wins. That makes it one of the most useful files in IT, and one of the most common reasons a site “works for everyone except me”.

NyxEvery IT person has one forgotten hosts entry pointing at a server that died years ago. Steven has three. Allegedly.

What it looks like

One entry per line: an IP address, some spaces or a tab, then one or more names. Anything after # is a comment. An example:

# IP address      name(s)
127.0.0.1         localhost
::1               localhost
192.168.1.50      nas.home   nas
10.0.0.20         staging.example.com
0.0.0.0           ads.example.net

• Lines 1–2: localhost on IPv4 and IPv6. On Windows these ship commented out, because Windows answers for localhost itself.
• Line 3: a name for a device on your home network, with a short alias.
• Line 4: send one site to a test server, on this computer only.
• Line 5: block a domain by pointing it at 0.0.0.0, an address that goes nowhere.

Where it lives

• Windows: C:\Windows\System32\drivers\etc\hosts (no file extension).
• Linux and macOS: /etc/hosts.
• Phones: there is one, but you can't edit it without rooting or jailbreaking. Use a DNS-based blocker instead.

View it

PS> Get-Content $env:windir\System32\drivers\etc\hosts

$ cat /etc/hosts

Edit it safely

1. Back it up first. Copy the file somewhere before you change it.
2. Open it with admin rights. Windows: start Notepad with Run as administrator, then File → Open, paste the path above, and set the file type to All files. Linux and macOS: sudo nano /etc/hosts.
3. Add your line, save, and keep a comment saying who added it and why. Future you will be grateful.
4. Flush the DNS cache so the change takes effect straight away: ipconfig /flushdns on Windows, resolvectl flush-caches on Linux with systemd-resolved, sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder on macOS. Browsers keep their own cache too, so close and reopen the browser.
5. Test with ping, not nslookup. ping staging.example.com goes through the operating system and uses the hosts file. nslookup goes straight to DNS and ignores it, which is exactly why the two can disagree.

What localhost actually is

localhost means “this computer”. It points at the loopback address, 127.0.0.1 (IPv4) or ::1 (IPv6). Traffic to it never leaves your machine, not even to the network card. That's why the Juice Shop lab binds a deliberately vulnerable app to 127.0.0.1: you can reach it, and nobody else on the network can.

Hosts file or DNS: who wins?

The hosts file is checked first. On Windows the DNS Client service loads hosts entries into its cache, so they show up in ipconfig /displaydns alongside real DNS answers. On Linux the order is set in /etc/nsswitch.conf; the usual line, hosts: files dns, means “hosts file, then DNS”.

Pros: when it's the right tool

• Instant override, no DNS server needed. One line and it works, even offline.
• Testing before a cut-over. Point a domain at the new server on your machine only, check everything, then change the real DNS.
• Home and lab names. Give your NAS or lab VMs friendly names without running a DNS server.
• Blocking. Point known ad, tracking or malware domains at 0.0.0.0.
• Development. Local names like myapp.test for sites you are building.

Cons: why it causes so many tickets

• One machine only. It doesn't scale, and nobody else can see what you've changed.
• Forgotten entries. A server moves to a new IP, DNS is updated, and the one PC with an old hosts line keeps going to the old address. Classic “works for everyone but me”.
• It hides from the usual tools. nslookup and dig ignore it, so they say everything is fine while the browser goes somewhere else.
• No wildcards and no record types. It maps names to addresses and nothing else. No SRV records, so it can't stand in for DNS in Active Directory, where clients find domain controllers through DNS.
• Needs admin rights, and very large block lists can slow name lookups on some systems.
• A favourite target for malware (see below).

Attack, then detect

The attack: because the hosts file wins over DNS, malware has long added lines that send banking, webmail or software-update sites to an attacker's server, or point security vendors' update sites at 0.0.0.0 so protection quietly stops updating.

The detection: treat any change to the hosts file as worth an alert. Wazuh's file-integrity monitoring can watch the path; Sysmon file events show which process touched it; Microsoft Defender flags some hosts edits as hijacking. On managed machines, keep the file at its default and do name changes in DNS, where they're visible and logged.

Troubleshooting checklist

• A site works for others but not you: check the hosts file first. It takes ten seconds.
• ping and nslookup show different IPs: the hosts file, or a stale cache. Flush and compare again.
• Your edit isn't working: saved without admin rights (Windows may silently save a copy elsewhere), the file got a .txt extension, or the browser is still using its own cache.

Interview quick-fire

• Hosts file or DNS, which is checked first? The hosts file.
• What is 127.0.0.1? The IPv4 loopback address: this computer.
• Why would nslookup and ping disagree? nslookup asks DNS directly; ping uses the operating system's resolver, which includes the hosts file and cache.

Spotted something?

Nova wrote this sheet from Steven’s ideas and support stories. If something is wrong or out of date, or you have a hosts-file horror story, tell us. No promises on timing.

Back to the lessonWhat happens when you type a URL and press Enter→