3

I use a Pihole on my network to provide local DNS service to block ads and various websites. I've noticed recently (maybe since Mojave) that Safari seems to bypass this. The Pihole device also functions as my DHCP server, and is configured to broadcast to clients that they should use its IP as the DNS server.

  • Running nslookup from the console indicates that the OS knows that the Pihole's IP is its DNS server.
  • Looking up known advertising domains via nslookup properly returns the Pihole's IP address (indicating that an ad coming from there would be blocked).
  • In the Network preferences pane, under DNS for the network interface, the Pihole's IP address is shown under DNS Servers.
  • Other web browsers (Chrome & Firefox) on the same MacBook Pro do not display the ads that Safari displays.
  • I have outbound port 53 blocked at my router for any device but the Pihole - switching nslookup's server to 8.8.8.8 (Google DNS) results in a connection timeout (which I'd expect with the outbound port blocked).
  • No other device on my network exhibits this behavior - including iOS devices.

networksetup -getdnsservers Wi-Fi reports "There aren't any DNS Servers set on Wi-Fi." If I manually set it via networksetup -setdnsservers Wi-Fi 192.168.1.22 the situation gets better but Safari's behavior still doesn't match Chrome's. And that's not really a viable solution long-term as I'll have to unset it every time I leave my home network.

Does Safari have some other means of doing DNS lookups that's hidden? How could it be bypassing DNS settings?

  • Have you tried clearing Safari's cache? – Allan Nov 24 '18 at 13:36
  • @Allan yes, I've used Empty Caches on the Developer menu several times. – alroc Nov 24 '18 at 14:50
  • It sounds like you've done a pretty good job of covering all of your bases... as far as IPv4 is concerned. Maybe it's IPv6 that's causing you headaches? Have you tried disabling IPv6 on the connection that's having this problem? – apocalysque Mar 27 at 0:10
  • How about Safari extensions? Do you have any extensions, like content blockers that maybe do their own DNS lookups? Try disabling all Safari extensions. – Jamie Cox Mar 27 at 0:52
  • @JamieCox the only extensions I have installed are 1Password, Reddit Enhancement Suite, and (as of tonight) uBlock Origin. – alroc Mar 27 at 1:03
3
+100

It sounds like you've done a pretty good job of covering all of your bases... as far as IPv4 is concerned. Maybe it's IPv6 that's causing you headaches? I believe that disabling IPv6 on the connection will fix the problem. IIRC IPv6 can autoconfigure itself without DHCP. If the rest of your network works with IPv6 then the queries could still be working over IPv6.

  • The usual way for IPv6 to be configured is from router(s) sending out router advertisements. (There's also DHCPv6, but it's rare.) The router advertisements include the local network prefix, router address, and DNS server(s) to use. Any IPv6 DNS servers will be listed in /etc/resolv.conf, and also in System Preferences -> Network pane -> Advanced button -> DNS tab. – Gordon Davisson Mar 27 at 4:19
0

You should try setting up a "Location" from System Preferences--> Network. Then, for that location, go to Advanced...DNS Servers for your network device (eth0, Wi-Fi, etc) and point it at your Pihole device. You need to specify both an IPv4 and an IPv6 DNS server.

From the same panel, if you click TCP/IP, you can confirm which DHCP information you're using and disable IPv6 (change it to link local only or manual with a bogus address).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .