macOS DNS Troubleshooting & Enterprise Management Guide

1. Quick Answer: Flushing macOS DNS Cache

To immediately clear cached hostnames and reset the resolver daemon on macOS Sequoia, Sonoma, and Ventura, run the following combined command in Terminal:

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

2. How DNS Resolution Works on macOS

Unlike Linux systems which rely primarily on /etc/resolv.conf, macOS handles DNS resolution through system configuration daemons centered around mDNSResponder and configd.

When an application makes a network request (e.g., curl https://api.mactechbuds.com), the query follows this path:

1. Local Hosts File: Evaluates /etc/hosts for direct IP overrides.
2. mDNSResponder Cache: Checks memory for recently resolved domain records.
3. Scutil Resolver Definitions: Queries network interface resolvers configured in DynamicStore.
4. Upstream Resolver: Transmits UDP/TCP port 53 packets (or encrypted DoH queries) to designated DNS servers (e.g., 1.1.1.1, 8.8.8.8, or internal active directory DNS).

3. Step-by-Step Diagnostic Instructions

3.1 Inspecting Active Network Resolvers

Do not rely on cat /etc/resolv.conf on macOS because it only shows the primary interface. Use scutil --dns to inspect all scoped resolvers:

# Show active DNS resolvers and search domains
scutil --dns

# Filter specifically for nameservers
scutil --dns | grep -E "nameserver\[[0-9]+\]"

3.2 Querying Domain Names with dig

The dig (Domain Information Groper) command provides exact record queries, response timing, and authoritative answer status:

# Standard A record lookup with execution time
dig mactechbuds.com

# Query a specific public DNS resolver directly
dig mactechbuds.com @1.1.1.1

# Trace the full delegation path from root servers
dig mactechbuds.com +trace

4. Troubleshooting Common DNS Errors

4.1 Fixing NXDOMAIN Errors

An NXDOMAIN (Non-Existent Domain) status indicates that the upstream DNS server searched authoritative zone files and found no record for the requested hostname.

• Cause: Typo in hostname, missing CNAME record, or stale DNS caching after a domain migration.
• Solution: Flush local cache with sudo killall -HUP mDNSResponder and verify record propagation using dig +trace domain.com.

4.2 Fixing SERVFAIL Errors

A SERVFAIL response means the DNS server was unable to complete the query due to internal failure or broken DNSSEC validation chain.

• Solution: Test against alternate public resolvers to isolate whether the issue is local network filtering or DNSSEC misconfiguration:

# Compare response across Cloudflare, Google, and Quad9
dig example.com @1.1.1.1 +short
dig example.com @8.8.8.8 +short
dig example.com @9.9.9.9 +short

5. Enterprise MDM Deployment (Jamf Pro / Kandji)

For corporate macOS fleets, DNS configurations should be enforced using signed .mobileconfig profiles configured for DNS Settings or Encrypted DNS (DoH / DoT).

Configuration profile key keys under com.apple.dnsSettings.managed payload:

<key>DNSSettings</key>
<dict>
    <key>DNSProtocol</key>
    <string>HTTPS</string>
    <key>ServerURL</key>
    <string>https://cloudflare-dns.com/dns-query</string>
    <key>ServerAddresses</key>
    <array>
        <string>1.1.1.1</string>
        <string>1.0.0.1</string>
    </array>
</dict>

6. Frequently Asked Questions (FAQ)