MacOS – Alternate DNS resolution for Safari on macOS

dnsmacosNetworksafari

I use a Pihole on my network to provide local DNS service to block ads and various websites. I've noticed recently (maybe since Mojave) that Safari seems to bypass this. The Pihole device also functions as my DHCP server, and is configured to broadcast to clients that they should use its IP as the DNS server.

Running nslookup from the console indicates that the OS knows that the Pihole's IP is its DNS server.
Looking up known advertising domains via nslookup properly returns the Pihole's IP address (indicating that an ad coming from there would be blocked).
In the Network preferences pane, under DNS for the network interface, the Pihole's IP address is shown under DNS Servers.
Other web browsers (Chrome & Firefox) on the same MacBook Pro do not display the ads that Safari displays.
I have outbound port 53 blocked at my router for any device but the Pihole – switching nslookup's server to 8.8.8.8 (Google DNS) results in a connection timeout (which I'd expect with the outbound port blocked).
No other device on my network exhibits this behavior – including iOS devices.

networksetup -getdnsservers Wi-Fi reports "There aren't any DNS Servers set on Wi-Fi." If I manually set it via networksetup -setdnsservers Wi-Fi 192.168.1.22 the situation gets better but Safari's behavior still doesn't match Chrome's. And that's not really a viable solution long-term as I'll have to unset it every time I leave my home network.

Does Safari have some other means of doing DNS lookups that's hidden? How could it be bypassing DNS settings?

Best Answer

It sounds like you've done a pretty good job of covering all of your bases... as far as IPv4 is concerned. Maybe it's IPv6 that's causing you headaches? I believe that disabling IPv6 on the connection will fix the problem. IIRC IPv6 can autoconfigure itself without DHCP. If the rest of your network works with IPv6 then the queries could still be working over IPv6.

OS X 10.10.0 – 10.10.3, Yosemite

Apparently, mDNSResponder doesn't exist in Yosemite (OS X 10.10). You can restart descoveryd instead to fix these issues.

sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.discoveryd.plist
sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.discoveryd.plist

OS X 10.10.4+, Yosemite

In OSX 10.10.4 the mDNSResponder has been reintroduced. So use the first one will work again.

MacOS – Do /etc/resolver/ files work in Mountain Lion for DNS resolution

This question seems a bit old, but I'm going to answer it anyways as I had a similar problem:

Yes, this works.

Your first problem is that you obviously have the wrong IP (8.8.8.8 instead of 203.12.160.35) in /etc/resolver/apple.com. Verify that the contents of this file is really:

nameserver 203.12.160.35

Then scutil --dns should have an entry like this:

resolver #8
  domain   : apple.com
  nameserver[0] : 203.12.160.35

The second problem is that you tried to verify it using nslookup which does not use the DNS resolution mechanisms of OS X. If you look at the man page of nslookup you will find this:

Mac OS X NOTICE
   The nslookup command does not use the host name and address resolution or the DNS 
   query routing mechanisms used by other processes running on Mac OS X.  The results of 
   name or address queries printed by nslookup may differ from those found by other
   processes that use the Mac OS X native name and address resolution mechanisms. The 
   results of DNS queries may also differ from queries that use the Mac OS X DNS routing 
   library.

To check your DNS config you could do

dns-sd -G v4 images.apple.com

and verify if it yields the same IP as

nslookup images.apple.com 203.12.160.35

Best Answer

Related Solutions

MacOS – DNS not resolving on Mac OS X

OS X 10.10.0 – 10.10.3, Yosemite

OS X 10.10.4+, Yosemite

MacOS – Do /etc/resolver/ files work in Mountain Lion for DNS resolution

Related Question