Simple definition
Link-Local Multicast Name Resolution resolves names on a local network segment without DNS but can expose systems to spoofing attacks.
Purpose and use
LLMNR, Link-Local Multicast Name Resolution, lets devices resolve certain names on their local link without a central DNS answer.
How does it work?
It uses port 5355, primarily UDP multicast for queries. Its scope is limited to the relevant local link.
Example and verification
For inconsistent name resolution, determine whether an answer comes from the intended DNS server or a local fallback mechanism.
Points to watch
An LLMNR answer does not have the same trust relationship as administered DNS and can be spoofed on a hostile network.
In short
LLMNR is no substitute for reliable DNS design; assess its necessity and any decision to disable it against actual network requirements.