I'm running Mojave (10.14) and I have a Cisco AnyConnect VPN over which traffic for selected routes (determined by the VPN profile, out of my control) is sent.
Traffic routing works fine, the issue is that DNS resolution is taking place over the VPN for hostnames that are not on the internal network.
The output of
scutil --dns contains:
craig@TBMBP:~$ scutil --dns DNS configuration resolver #1 search domain : a.mycompany.com search domain : b.mycompany.com search domain : c.mycompany.com search domain : d.mycompany.com search domain : hsd1.ma.comcast.net <-- (my ISP) nameserver : 10.70.yy.yy
Further, it contains:
DNS configuration (for scoped queries) resolver #1 search domain : hsd1.ma.comcast.net nameserver : 2601:184:497f:... <-- (some ipv6 address) nameserver : 192.168.1.1 if_index : 10 (en0) flags : Scoped, Request A records, Request AAAA records reach : 0x00000002 (Reachable)
That means when I open www.apple.com, I see over the VPN:
39 2.316879 10.70.xx.xx 10.70.yy.yy DNS 63 Standard query 0xefee A www.apple.com
And I don't want this to happen. Rather, I want DNS resolution to happen between me and my ISP (or between me and
220.127.116.11) and then if resolution fails, to consult with the VPN.
How do I update the resolver to use Cloudflare/Google first for DNS, using the command line on Mac?