DNS is hard. all. the. time.
I recently moved to a Macbook Pro for my primary work laptop. I keep a Fedora 31 laptop handy, and I have a decent-sized home lab to doing Linux-y things. For browsing and surfing thoughs, a Macbook is a pretty good experience.
My home lab is what caused me to have to dig this up. My home network is Ubiquiti hardware, and it automatically manages my internal DNS zones and hostnames. I ❤ it. On my Linux laptop, I would quickly configure dnsmasq and be done with it.
But my work laptop automatically connects to my work VPN. Because my employer manages my configuration remotely, how can I have my home lab domain, int.jduncan.io not get pushed out to public servers for resolution where it will fail? Turns out, it’s really easy to set specific DNS resolvers for various domains.
First, check out your DNS configuration using $ scutil –dns . You’ll see a lot of different resolvers configured. In my case resolver #1 is what is handling my DNS lookups, then #2 handles the .local domain. Resolver #3 is the reverse lookup for the 169.254 APIPA address space, and so on. The root DNS servers for the internet are also listed.
scutil --dns DNS configuration resolver #1 search domain : vmware.com search domain : eng.vmware.com nameserver : 10.84.54.30 nameserver : 10.84.54.31 flags : Request A records reach : 0x00000002 (Reachable) order : 50000 resolver #2 domain : local options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300000 resolver #3 domain : 254.169.in-addr.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300200 resolver #4 domain : 8.e.f.ip6.arpa options : mdns timeout : 5 flags : Request A records reach : 0x00000000 (Not Reachable) order : 300400
To add an additional resolver to a Mac, create a directory at /etc/resolver.
$ sudo mkdir /etc/resolver
For each domain that you want to hit a specific nameserver, create a file with the name of your desired domain and a nameserver line (or lines) in the file. For my internal domain I used the following command:
cat 'nameserver 192.168.1.1' > /etc/resolver/int.jduncan.io
Now, when I run scutil –dns again I see my newly created resolver:
resolver #8 domain : int.jduncan.io nameserver : 192.168.1.1 flags : Request A records reach : 0x00020002 (Reachable,Directly Reachable Address)
A quick lookup confirms that my configuration is doing what I want it to do. Another thing I discovered when looking into this is that dig and nslookup on OSX don’t use the OS resolver configuration.
$ dscacheutil -q host -a name vcenter.int.jduncan.io name: vcenter.int.jduncan.io ip_address: 192.168.10.110
And that’s it. If I want to configure forward or reverse zones to resolving using a specific nameserver on OSX it’s that simple.