MacOS keeps reverting to static DNS IP addresses

dnsmacosmojave

I have a strange issue that only started occurring recently (within the last 2 public OS update releases). The DNS IP addresses for all interfaces (at least, the WiFi and Ethernet interfaces) are being statically set, rather than being assigned via DHCP each time. When this happens, I can delete the entries and let it revert to whatever IP addresses it received via DHCP, but the next time the computer brings up the interfaces (either during a boot process or just because I told it to disconnect from the network by some means), the static entries come back. The only way I've been able to get it to behave for at least a day or two, is by deleting the preferences.plist out of /Library/Preferences/SystemConfiguration. I've gone as far as editing the file rather than deleting it, but that didn't last. The reason this is a problem is when switching networks (for example, between home and work), where when I get home, it will have my work network's IP addresses in it and won't work, and the inverse happens when I've used it at home and then come to work.

Edit 1:
For the sake of clarity, to those that are not network engineers or are just confused, DHCP assigns DNS server IP addresses to clients via option 6, and they are whatever the server/system/network engineer wants them to be. What's happening is that instead of those assigned IP addresses dynamically being set and removed at each connection/disconnection, macOS receives the assignments initially and then, instead of leaving them as DHCP assigned entries, converts them to statically set entries in the preferences.plist, so that each time the interface is used, it will try using them again, rather than using whatever DHCP is assigning.

Edit 2:
When this happens, macOS still receives DHCP option 6 (DNS server IP addresses) – it just doesn't use them (it overrides them) and forces the use of the DNS server IP addresses that it has now statically set. Once you remove the static entries, you are left with the dynamically received entries.

Edit 3:
This is NOT a resolution issue, in that an IP address or FQDN is being resolve incorrectly or being overridden by a static hosts file entry.

Edit 4:
I've submitted this bug/behavior to Apple via their Feedback portal to see if they can figure it out, too.

Edit 5: Here are the requested outputs (this is while at my office, after clearing the static entries once again):

scutil --dns
DNS configuration

resolver #1
  search domain[0] : TCC.local
  nameserver[0] : 192.168.6.97
  nameserver[1] : 192.168.6.96
  if_index : 7 (en0)
  flags    : Request A records
  reach    : 0x00000002 (Reachable)

resolver #2
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #3
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #4
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #5
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #6
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #7
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  search domain[0] : TCC.local
  nameserver[0] : 192.168.6.97
  nameserver[1] : 192.168.6.96
  if_index : 7 (en0)
  flags    : Scoped, Request A records
  reach    : 0x00000002 (Reachable)


DirectoryService Cache search policy:
    /Local/Default

Unable to get details from the cache node
Unable to get cache configuration information


networksetup -getcurrentlocation
Automatic


networksetup -listlocations
Automatic


networksetup -listnetworkserviceorder
An asterisk (*) denotes that a network service is disabled.
(1) Ethernet
(Hardware Port: Ethernet, Device: en0)

(2) FireWire
(Hardware Port: FireWire, Device: fw0)

(3) Wi-Fi
(Hardware Port: Wi-Fi, Device: en1)

(4) Bluetooth PAN
(Hardware Port: Bluetooth PAN, Device: en3)

(5) Thunderbolt Bridge
(Hardware Port: Thunderbolt Bridge, Device: bridge0)

(6) PureVPN
(Hardware Port: IPSec, Device: )


networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
Ethernet
FireWire
Wi-Fi
Bluetooth PAN
Thunderbolt Bridge
PureVPN


networksetup -listallhardwareports

Hardware Port: Ethernet
Device: en0
Ethernet Address: 68:5b:35:96:38:ea

Hardware Port: FireWire
Device: fw0
Ethernet Address: 44:fb:42:ff:fe:bf:79:f8

Hardware Port: Wi-Fi
Device: en1
Ethernet Address: a8:86:dd:8c:0b:94

Hardware Port: Bluetooth PAN
Device: en3
Ethernet Address: a8:86:dd:8c:0b:95

Hardware Port: Thunderbolt 1
Device: en2
Ethernet Address: d2:00:1b:f7:9f:80

Hardware Port: Thunderbolt Bridge
Device: bridge0
Ethernet Address: d2:00:1b:f7:9f:80

VLAN Configurations
===================


cat /etc/resolv.conf
#
# macOS Notice
#
# This file is not consulted for DNS hostname resolution, address
# resolution, or the DNS query routing mechanism used by most
# processes on this system.
#
# To view the DNS configuration used by this system, use:
#   scutil --dns
#
# SEE ALSO
#   dns-sd(1), scutil(8)
#
# This file is automatically generated.
#
domain TCC.local
nameserver 192.168.6.97
nameserver 192.168.6.96

Edit 6:

cat /etc/resolv.conf
#
# macOS Notice
#
# This file is not consulted for DNS hostname resolution, address
# resolution, or the DNS query routing mechanism used by most
# processes on this system.
#
# To view the DNS configuration used by this system, use:
#   scutil --dns
#
# SEE ALSO
#   dns-sd(1), scutil(8)
#
# This file is automatically generated.
#
domain hsd1.in.comcast.net
nameserver 2001:558:feed::1
nameserver 2001:558:feed::2
nameserver 75.75.75.75
nameserver 75.75.76.76

Edit 7:
Here are screenshots of the timestamp for preferences.plist (and other files in that location) before and after just a simple reboot. Before the reboot, all static DNS entries were cleared via the Network preferences pane, to revert back to solely DHCP-provided addresses on all services/interfaces. I also dumped the preferences.plist before and after, so you can all see what changes. Again, this is just from a simple reboot.

Before Reboot:
Before Reboot

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CurrentSet</key>
    <string>/Sets/A3AFD782-9440-4041-9917-4543E586292F</string>
    <key>Model</key>
    <string>MacBookPro9,2</string>
    <key>NetworkServices</key>
    <dict>
        <key>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</key>
        <dict>
            <key>DNS</key>
            <dict/>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en3</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Bluetooth PAN</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Bluetooth PAN</string>
        </dict>
        <key>8EF91F03-0D57-497C-804A-520F907E8D91</key>
        <dict>
            <key>DNS</key>
            <dict/>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en1</string>
                <key>Hardware</key>
                <string>AirPort</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Wi-Fi</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Wi-Fi</string>
        </dict>
        <key>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</key>
        <dict>
            <key>DNS</key>
            <dict/>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en0</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Ethernet</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Ethernet</string>
        </dict>
        <key>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</key>
        <dict>
            <key>DNS</key>
            <dict/>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>fw0</string>
                <key>Hardware</key>
                <string>FireWire</string>
                <key>Type</key>
                <string>FireWire</string>
                <key>UserDefinedName</key>
                <string>FireWire</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>FireWire</string>
        </dict>
        <key>F8317569-4A38-4C57-AA0B-118B86ED464F</key>
        <dict>
            <key>DNS</key>
            <dict/>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>bridge0</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Thunderbolt Bridge</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Thunderbolt Bridge</string>
        </dict>
    </dict>
    <key>Sets</key>
    <dict>
        <key>A3AFD782-9440-4041-9917-4543E586292F</key>
        <dict>
            <key>Network</key>
            <dict>
                <key>Global</key>
                <dict>
                    <key>IPv4</key>
                    <dict>
                        <key>ServiceOrder</key>
                        <array>
                            <string>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</string>
                            <string>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</string>
                            <string>8EF91F03-0D57-497C-804A-520F907E8D91</string>
                            <string>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</string>
                            <string>F8317569-4A38-4C57-AA0B-118B86ED464F</string>
                        </array>
                    </dict>
                </dict>
                <key>Interface</key>
                <dict>
                    <key>en1</key>
                    <dict>
                        <key>AirPort</key>
                        <dict>
                            <key>JoinModeFallback</key>
                            <array>
                                <string>DoNothing</string>
                            </array>
                            <key>PowerEnabled</key>
                            <true/>
                            <key>RememberJoinedNetworks</key>
                            <true/>
                            <key>RequireAdminIBSS</key>
                            <false/>
                            <key>RequireAdminNetworkChange</key>
                            <false/>
                            <key>RequireAdminPowerToggle</key>
                            <false/>
                            <key>Version</key>
                            <integer>2500</integer>
                        </dict>
                    </dict>
                </dict>
                <key>Service</key>
                <dict>
                    <key>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/4CD8DB21-0AC8-40A5-83C6-094D249CFE68</string>
                    </dict>
                    <key>8EF91F03-0D57-497C-804A-520F907E8D91</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/8EF91F03-0D57-497C-804A-520F907E8D91</string>
                    </dict>
                    <key>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</string>
                    </dict>
                    <key>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/C0B49A31-0F0A-4BAA-81FF-BAD549404F50</string>
                    </dict>
                    <key>F8317569-4A38-4C57-AA0B-118B86ED464F</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/F8317569-4A38-4C57-AA0B-118B86ED464F</string>
                    </dict>
                </dict>
            </dict>
            <key>UserDefinedName</key>
            <string>Automatic</string>
        </dict>
    </dict>
    <key>VirtualNetworkInterfaces</key>
    <dict>
        <key>Bridge</key>
        <dict>
            <key>bridge0</key>
            <dict>
                <key>Interfaces</key>
                <array>
                    <string>en2</string>
                </array>
                <key>Options</key>
                <dict>
                    <key>__AUTO__</key>
                    <string>thunderbolt-bridge</string>
                </dict>
            </dict>
        </dict>
    </dict>
</dict>
</plist>

After Reboot:
After Reboot

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CurrentSet</key>
    <string>/Sets/A3AFD782-9440-4041-9917-4543E586292F</string>
    <key>Model</key>
    <string>MacBookPro9,2</string>
    <key>NetworkServices</key>
    <dict>
        <key>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</key>
        <dict>
            <key>DNS</key>
            <dict>
                <key>ServerAddresses</key>
                <array>
                    <string>192.168.6.97</string>
                    <string>192.168.6.96</string>
                </array>
            </dict>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en3</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Bluetooth PAN</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Bluetooth PAN</string>
        </dict>
        <key>8EF91F03-0D57-497C-804A-520F907E8D91</key>
        <dict>
            <key>DNS</key>
            <dict>
                <key>ServerAddresses</key>
                <array>
                    <string>192.168.6.97</string>
                    <string>192.168.6.96</string>
                </array>
            </dict>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en1</string>
                <key>Hardware</key>
                <string>AirPort</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Wi-Fi</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Wi-Fi</string>
        </dict>
        <key>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</key>
        <dict>
            <key>DNS</key>
            <dict>
                <key>ServerAddresses</key>
                <array>
                    <string>192.168.6.97</string>
                    <string>192.168.6.96</string>
                </array>
            </dict>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en0</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Ethernet</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Ethernet</string>
        </dict>
        <key>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</key>
        <dict>
            <key>DNS</key>
            <dict>
                <key>ServerAddresses</key>
                <array>
                    <string>192.168.6.97</string>
                    <string>192.168.6.96</string>
                </array>
            </dict>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>fw0</string>
                <key>Hardware</key>
                <string>FireWire</string>
                <key>Type</key>
                <string>FireWire</string>
                <key>UserDefinedName</key>
                <string>FireWire</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>FireWire</string>
        </dict>
        <key>F8317569-4A38-4C57-AA0B-118B86ED464F</key>
        <dict>
            <key>DNS</key>
            <dict>
                <key>ServerAddresses</key>
                <array>
                    <string>192.168.6.97</string>
                    <string>192.168.6.96</string>
                </array>
            </dict>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>bridge0</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Thunderbolt Bridge</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Thunderbolt Bridge</string>
        </dict>
    </dict>
    <key>Sets</key>
    <dict>
        <key>A3AFD782-9440-4041-9917-4543E586292F</key>
        <dict>
            <key>Network</key>
            <dict>
                <key>Global</key>
                <dict>
                    <key>IPv4</key>
                    <dict>
                        <key>ServiceOrder</key>
                        <array>
                            <string>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</string>
                            <string>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</string>
                            <string>8EF91F03-0D57-497C-804A-520F907E8D91</string>
                            <string>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</string>
                            <string>F8317569-4A38-4C57-AA0B-118B86ED464F</string>
                        </array>
                    </dict>
                </dict>
                <key>Interface</key>
                <dict>
                    <key>en1</key>
                    <dict>
                        <key>AirPort</key>
                        <dict>
                            <key>JoinModeFallback</key>
                            <array>
                                <string>DoNothing</string>
                            </array>
                            <key>PowerEnabled</key>
                            <true/>
                            <key>RememberJoinedNetworks</key>
                            <true/>
                            <key>RequireAdminIBSS</key>
                            <false/>
                            <key>RequireAdminNetworkChange</key>
                            <false/>
                            <key>RequireAdminPowerToggle</key>
                            <false/>
                            <key>Version</key>
                            <integer>2500</integer>
                        </dict>
                    </dict>
                </dict>
                <key>Service</key>
                <dict>
                    <key>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/4CD8DB21-0AC8-40A5-83C6-094D249CFE68</string>
                    </dict>
                    <key>8EF91F03-0D57-497C-804A-520F907E8D91</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/8EF91F03-0D57-497C-804A-520F907E8D91</string>
                    </dict>
                    <key>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</string>
                    </dict>
                    <key>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/C0B49A31-0F0A-4BAA-81FF-BAD549404F50</string>
                    </dict>
                    <key>F8317569-4A38-4C57-AA0B-118B86ED464F</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/F8317569-4A38-4C57-AA0B-118B86ED464F</string>
                    </dict>
                </dict>
            </dict>
            <key>UserDefinedName</key>
            <string>Automatic</string>
        </dict>
    </dict>
    <key>VirtualNetworkInterfaces</key>
    <dict>
        <key>Bridge</key>
        <dict>
            <key>bridge0</key>
            <dict>
                <key>Interfaces</key>
                <array>
                    <string>en2</string>
                </array>
                <key>Options</key>
                <dict>
                    <key>__AUTO__</key>
                    <string>thunderbolt-bridge</string>
                </dict>
            </dict>
        </dict>
    </dict>
</dict>
</plist>

Edit 8:

sudo grep -r "192.168.6.97" /Library/Preferences

/Library/Preferences//SystemConfiguration/com.apple.smb.server.plist:       <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
Binary file /Library/Preferences//com.apple.networkextension.plist matches
grep: /Library/Preferences//com.apple.TimeMachine.plist: Operation not permitted

sudo grep -r "192.168.6.97" ~/Library/Preferences

Binary file /Users/jessepeden/Library/Preferences//com.purevpn.macapp.App.plist matches
grep: /Users/jessepeden/Library/Preferences//com.apple.mail-shared.plist: Operation not permitted
grep: /Users/jessepeden/Library/Preferences//com.apple.homed.notbackedup.plist: Operation not permitted
grep: /Users/jessepeden/Library/Preferences//com.apple.homed.plist: Operation not permitted

Edit 9:
The output exceeds the 30,000 character limit on here, so I've put it on PasteBin.
com.apple.networkextension.plist

Edit 10:

Just an update. After some back-and-forth with PureVPN's front-line support, I was able to escalate to their macOS developers and get a remote support session going so they could verify the claims about their software being the culprit. They have flagged the issue for remediation in a future release of PureVPN.

Edit 11:

As of September 11, 2020, PureVPN has still not fixed this bug and I still use an Automator script/app I wrote to reset all interfaces back to using DHCP (undoing the static settings that PureVPN is forcing).

OS: macOS 10.14.6 (Mojave)

Hardware: MacBook Pro (Mid 2012)

Best Answer

You can find the cause using the Logger, here are several examples [if you need any detailed info], and at the end I show how to use the best 3 combinations for your case (video included):

On the end, using the 3 commands, they monitor in realtime any DNS changes by directly monitoring the system configuration root daemon, also any Network System Configuration FILE changes, and also the root Network Diagnostic sub-system.

You need to keep those 3 commands open in terminal, UNTIL your DNS issue changes happens, and it will be logged.

Keep them running all the time until the issue happens.

These commands will show you Which process/application/network/whatever is causing the changes, and you can monitor it on Realtime, and also query past events to find the past changes.

1) Filter symptonsd messages:

log show --predicate 'subsystem == "com.apple.symptomsd" AND category != "flow"' --info --debug --signpost --style compact

enter image description here

2) Filter messages about DNS (case insensitive)

log show --predicate 'subsystem == "com.apple.symptomsd" AND category != "flow" AND message CONTAINS[cd] "DNS"' --info --debug --signpost --style compact --last 30m

enter image description here

3) Filtrar atraves do System Configuration por alteracoes: log show --predicate 'subsystem == "com.apple.SystemConfiguration" and category !="SCNetworkReachability" ' --info --debug --signpost --style compact --last 30m

enter image description here

4) Filter what is changing DNS system configuration: log show --predicate 'subsystem == "com.apple.SystemConfiguration" and message CONTAINS[cd] "DNS" ' --info --debug --signpost --style compact --last 10m

enter image description here

5) Filter by the Configuration Daemon: log show --predicate 'subsystem == "com.apple.IPConfiguration" ' --info --debug --signpost --style compact --last 10m

enter image description here

6) Filter via interface using CoreUtils -> InterfaceMonitor log show --predicate 'subsystem == "com.apple.CoreUtils" and category == "CUNetInterfaceMonitor" ' --info --debug --signpost --style compact --last 15m

enter image description here

7) Filter via CoreUtils and rapportd log show --predicate 'subsystem == "com.apple.CoreUtils" and process == "rapportd" ' --info --debug --signpost --style compact --start "2019-08-11 14:21:45" --end "2019-08-11 14:22:00"

enter image description here

8) All CoreUtils events at the same time/date interval [as above]: log show --predicate 'subsystem == "com.apple.CoreUtils" ' --info --debug --signpost --style compact --start "2019-08-11 14:21:45" --end "2019-08-11 14:22:00"

enter image description here

9) Filter all events CoreUtils -> System Monitor at the same interval: log show --predicate 'subsystem == "com.apple.CoreUtils" and category == "CUSystemMonitor" ' --info --debug --signpost --style compact --start "2019-08-11 14:21:45" --end "2019-08-11 14:22:00"

enter image description here

The 3 commands DNS Realtime Monitor

I made a video, about using 3 of them. I think they are the best for you and will for sure help you find the reason and when/who/what is changing your MacOS DNS configuration.

Open iTerm with 3 split terminal screens, or open 3 macOS Terminal windows.

Put each command below on each specific terminal window.

Keep them running all the time until the DNS issue happens and your DNS changes. And they will be logged on the 3 terminal windows.

log stream --predicate 'subsystem == "com.apple.IPConfiguration"


log stream --predicate 'subsystem == "com.apple.symptomsd" AND category != "flow" AND message CONTAINS[cd] "DNS"' --info --debug --signpost --style compact


log stream --predicate 'subsystem == "com.apple.SystemConfiguration"  and (message CONTAINS "com.apple.system.config.network_change" OR message CONTAINS "changedKeys") and (message CONTAINS[cd] "DNS") ' --info --debug --signpost --style compact

On the video I am using the 3 commands below on iTerm split window:

Youtube link for the video:

https://youtu.be/yebQH6dEZvU

enter image description here

Temporary helper debug stuff

Contents of an original clean Mojave /Library/Preferences/com.apple.networkextension.plist file


$ defaults read /Library/Preferences/com.apple.networkextension.plist

{
    "$archiver" = NSKeyedArchiver;
    "$objects" =     (
        "$null",
                {
            "$class" = "<CFKeyedArchiverUID 0x7ffbd1402c20 [0x7fff9c6698e0]>{value = 2}";
            "NS.data" = <04000001 00000000 ff560d00 03000000 c90c4f5d 00000000 c1529216 00000000 a5080000 00000000>;
        },
                {
            "$classes" =             (
                NSMutableData,
                NSData,
                NSObject
            );
            "$classname" = NSMutableData;
        }
    );
    "$top" =     {
        SCPreferencesSignature2 = "<CFKeyedArchiverUID 0x7ffbd1402ea0 [0x7fff9c6698e0]>{value = 1}";
        Version = 1;
    };
    "$version" = 100000;
}
Related Question