Domain-specific DNS server on your Macbook Pro

Jamie Duncan
Nov 12, 2019 · 3 min read
DNS is hard. all. the. time.

I recently moved to a Macbook Pro for my primary work laptop. I keep a Fedora 31 laptop handy, and I have a decent-sized home lab to doing Linux-y things. For browsing and surfing thoughs, a Macbook is a pretty good experience.

My home lab is what caused me to have to dig this up. My home network is Ubiquiti hardware, and it automatically manages my internal DNS zones and hostnames. I ❤ it. On my Linux laptop, I would quickly configure dnsmasq and be done with it.

But my work laptop automatically connects to my work VPN. Because my employer manages my configuration remotely, how can I have my home lab domain, int.jduncan.io not get pushed out to public servers for resolution where it will fail? Turns out, it’s really easy to set specific DNS resolvers for various domains.

First, check out your DNS configuration using $ scutil --dns . You’ll see a lot of different resolvers configured. In my case resolver #1 is what is handling my DNS lookups, then #2 handles the .local domain. Resolver #3 is the reverse lookup for the 169.254 APIPA address space, and so on. The root DNS servers for the internet are also listed.

scutil --dns
DNS configuration
resolver #1
search domain[0] : vmware.com
search domain[1] : eng.vmware.com
nameserver[0] : 10.84.54.30
nameserver[1] : 10.84.54.31
flags : Request A records
reach : 0x00000002 (Reachable)
order : 50000
resolver #2
domain : local
options : mdns
timeout : 5
flags : Request A records
reach : 0x00000000 (Not Reachable)
order : 300000
resolver #3
domain : 254.169.in-addr.arpa
options : mdns
timeout : 5
flags : Request A records
reach : 0x00000000 (Not Reachable)
order : 300200
resolver #4
domain : 8.e.f.ip6.arpa
options : mdns
timeout : 5
flags : Request A records
reach : 0x00000000 (Not Reachable)
order : 300400

To add an additional resolver to a Mac, create a directory at /etc/resolver.

$ sudo mkdir /etc/resolver

For each domain that you want to hit a specific nameserver, create a file with the name of your desired domain and a nameserver line (or lines) in the file. For my internal domain I used the following command:

cat 'nameserver 192.168.1.1' > /etc/resolver/int.jduncan.io

Now, when I run scutil --dns again I see my newly created resolver:

resolver #8
domain : int.jduncan.io
nameserver[0] : 192.168.1.1
flags : Request A records
reach : 0x00020002 (Reachable,Directly Reachable Address)

A quick lookup confirms that my configuration is doing what I want it to do. Another thing I discovered when looking into this is that dig and nslookup on OSX don’t use the OS resolver configuration.

$ dscacheutil -q host -a name vcenter.int.jduncan.io
name: vcenter.int.jduncan.io
ip_address: 192.168.10.110

And that’s it. If I want to configure forward or reverse zones to resolving using a specific nameserver on OSX it’s that simple.

Jamie Duncan

Written by

Linux Pro. F1 Geek. Dad. Wannabe Farmer. VMWare Kubernetes architect. Former Red Hatter. My opinions not the company.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade