3

I have a strange issue that only started occurring recently (within the last 2 public OS update releases). The DNS IP addresses for all interfaces (at least, the WiFi and Ethernet interfaces) are being statically set, rather than being assigned via DHCP each time. When this happens, I can delete the entries and let it revert to whatever IP addresses it received via DHCP, but the next time the computer brings up the interfaces (either during a boot process or just because I told it to disconnect from the network by some means), the static entries come back. The only way I've been able to get it to behave for at least a day or two, is by deleting the preferences.plist out of /Library/Preferences/SystemConfiguration. I've gone as far as editing the file rather than deleting it, but that didn't last. The reason this is a problem is when switching networks (for example, between home and work), where when I get home, it will have my work network's IP addresses in it and won't work, and the inverse happens when I've used it at home and then come to work.

Edit 1: For the sake of clarity, to those that are not network engineers or are just confused, DHCP assigns DNS server IP addresses to clients via option 6, and they are whatever the server/system/network engineer wants them to be. What's happening is that instead of those assigned IP addresses dynamically being set and removed at each connection/disconnection, macOS receives the assignments initially and then, instead of leaving them as DHCP assigned entries, converts them to statically set entries in the preferences.plist, so that each time the interface is used, it will try using them again, rather than using whatever DHCP is assigning.

Edit 2: When this happens, macOS still receives DHCP option 6 (DNS server IP addresses) - it just doesn't use them (it overrides them) and forces the use of the DNS server IP addresses that it has now statically set. Once you remove the static entries, you are left with the dynamically received entries.

Edit 3: This is NOT a resolution issue, in that an IP address or FQDN is being resolve incorrectly or being overridden by a static hosts file entry.

Edit 4: I've submitted this bug/behavior to Apple via their Feedback portal to see if they can figure it out, too.

Edit 5: Here are the requested outputs (this is while at my office, after clearing the static entries once again):

scutil --dns
DNS configuration

resolver #1
  search domain[0] : TCC.local
  nameserver[0] : 192.168.6.97
  nameserver[1] : 192.168.6.96
  if_index : 7 (en0)
  flags    : Request A records
  reach    : 0x00000002 (Reachable)

resolver #2
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #3
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #4
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #5
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #6
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #7
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  search domain[0] : TCC.local
  nameserver[0] : 192.168.6.97
  nameserver[1] : 192.168.6.96
  if_index : 7 (en0)
  flags    : Scoped, Request A records
  reach    : 0x00000002 (Reachable)


DirectoryService Cache search policy:
    /Local/Default

Unable to get details from the cache node
Unable to get cache configuration information


networksetup -getcurrentlocation
Automatic


networksetup -listlocations
Automatic


networksetup -listnetworkserviceorder
An asterisk (*) denotes that a network service is disabled.
(1) Ethernet
(Hardware Port: Ethernet, Device: en0)

(2) FireWire
(Hardware Port: FireWire, Device: fw0)

(3) Wi-Fi
(Hardware Port: Wi-Fi, Device: en1)

(4) Bluetooth PAN
(Hardware Port: Bluetooth PAN, Device: en3)

(5) Thunderbolt Bridge
(Hardware Port: Thunderbolt Bridge, Device: bridge0)

(6) PureVPN
(Hardware Port: IPSec, Device: )


networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
Ethernet
FireWire
Wi-Fi
Bluetooth PAN
Thunderbolt Bridge
PureVPN


networksetup -listallhardwareports

Hardware Port: Ethernet
Device: en0
Ethernet Address: 68:5b:35:96:38:ea

Hardware Port: FireWire
Device: fw0
Ethernet Address: 44:fb:42:ff:fe:bf:79:f8

Hardware Port: Wi-Fi
Device: en1
Ethernet Address: a8:86:dd:8c:0b:94

Hardware Port: Bluetooth PAN
Device: en3
Ethernet Address: a8:86:dd:8c:0b:95

Hardware Port: Thunderbolt 1
Device: en2
Ethernet Address: d2:00:1b:f7:9f:80

Hardware Port: Thunderbolt Bridge
Device: bridge0
Ethernet Address: d2:00:1b:f7:9f:80

VLAN Configurations
===================


cat /etc/resolv.conf
#
# macOS Notice
#
# This file is not consulted for DNS hostname resolution, address
# resolution, or the DNS query routing mechanism used by most
# processes on this system.
#
# To view the DNS configuration used by this system, use:
#   scutil --dns
#
# SEE ALSO
#   dns-sd(1), scutil(8)
#
# This file is automatically generated.
#
domain TCC.local
nameserver 192.168.6.97
nameserver 192.168.6.96

Edit 6:

cat /etc/resolv.conf
#
# macOS Notice
#
# This file is not consulted for DNS hostname resolution, address
# resolution, or the DNS query routing mechanism used by most
# processes on this system.
#
# To view the DNS configuration used by this system, use:
#   scutil --dns
#
# SEE ALSO
#   dns-sd(1), scutil(8)
#
# This file is automatically generated.
#
domain hsd1.in.comcast.net
nameserver 2001:558:feed::1
nameserver 2001:558:feed::2
nameserver 75.75.75.75
nameserver 75.75.76.76

Edit 7: Here are screenshots of the timestamp for preferences.plist (and other files in that location) before and after just a simple reboot. Before the reboot, all static DNS entries were cleared via the Network preferences pane, to revert back to solely DHCP-provided addresses on all services/interfaces. I also dumped the preferences.plist before and after, so you can all see what changes. Again, this is just from a simple reboot.

Before Reboot: Before Reboot

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CurrentSet</key>
    <string>/Sets/A3AFD782-9440-4041-9917-4543E586292F</string>
    <key>Model</key>
    <string>MacBookPro9,2</string>
    <key>NetworkServices</key>
    <dict>
        <key>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</key>
        <dict>
            <key>DNS</key>
            <dict/>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en3</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Bluetooth PAN</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Bluetooth PAN</string>
        </dict>
        <key>8EF91F03-0D57-497C-804A-520F907E8D91</key>
        <dict>
            <key>DNS</key>
            <dict/>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en1</string>
                <key>Hardware</key>
                <string>AirPort</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Wi-Fi</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Wi-Fi</string>
        </dict>
        <key>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</key>
        <dict>
            <key>DNS</key>
            <dict/>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en0</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Ethernet</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Ethernet</string>
        </dict>
        <key>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</key>
        <dict>
            <key>DNS</key>
            <dict/>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>fw0</string>
                <key>Hardware</key>
                <string>FireWire</string>
                <key>Type</key>
                <string>FireWire</string>
                <key>UserDefinedName</key>
                <string>FireWire</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>FireWire</string>
        </dict>
        <key>F8317569-4A38-4C57-AA0B-118B86ED464F</key>
        <dict>
            <key>DNS</key>
            <dict/>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>bridge0</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Thunderbolt Bridge</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Thunderbolt Bridge</string>
        </dict>
    </dict>
    <key>Sets</key>
    <dict>
        <key>A3AFD782-9440-4041-9917-4543E586292F</key>
        <dict>
            <key>Network</key>
            <dict>
                <key>Global</key>
                <dict>
                    <key>IPv4</key>
                    <dict>
                        <key>ServiceOrder</key>
                        <array>
                            <string>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</string>
                            <string>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</string>
                            <string>8EF91F03-0D57-497C-804A-520F907E8D91</string>
                            <string>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</string>
                            <string>F8317569-4A38-4C57-AA0B-118B86ED464F</string>
                        </array>
                    </dict>
                </dict>
                <key>Interface</key>
                <dict>
                    <key>en1</key>
                    <dict>
                        <key>AirPort</key>
                        <dict>
                            <key>JoinModeFallback</key>
                            <array>
                                <string>DoNothing</string>
                            </array>
                            <key>PowerEnabled</key>
                            <true/>
                            <key>RememberJoinedNetworks</key>
                            <true/>
                            <key>RequireAdminIBSS</key>
                            <false/>
                            <key>RequireAdminNetworkChange</key>
                            <false/>
                            <key>RequireAdminPowerToggle</key>
                            <false/>
                            <key>Version</key>
                            <integer>2500</integer>
                        </dict>
                    </dict>
                </dict>
                <key>Service</key>
                <dict>
                    <key>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/4CD8DB21-0AC8-40A5-83C6-094D249CFE68</string>
                    </dict>
                    <key>8EF91F03-0D57-497C-804A-520F907E8D91</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/8EF91F03-0D57-497C-804A-520F907E8D91</string>
                    </dict>
                    <key>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</string>
                    </dict>
                    <key>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/C0B49A31-0F0A-4BAA-81FF-BAD549404F50</string>
                    </dict>
                    <key>F8317569-4A38-4C57-AA0B-118B86ED464F</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/F8317569-4A38-4C57-AA0B-118B86ED464F</string>
                    </dict>
                </dict>
            </dict>
            <key>UserDefinedName</key>
            <string>Automatic</string>
        </dict>
    </dict>
    <key>VirtualNetworkInterfaces</key>
    <dict>
        <key>Bridge</key>
        <dict>
            <key>bridge0</key>
            <dict>
                <key>Interfaces</key>
                <array>
                    <string>en2</string>
                </array>
                <key>Options</key>
                <dict>
                    <key>__AUTO__</key>
                    <string>thunderbolt-bridge</string>
                </dict>
            </dict>
        </dict>
    </dict>
</dict>
</plist>

After Reboot: After Reboot

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CurrentSet</key>
    <string>/Sets/A3AFD782-9440-4041-9917-4543E586292F</string>
    <key>Model</key>
    <string>MacBookPro9,2</string>
    <key>NetworkServices</key>
    <dict>
        <key>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</key>
        <dict>
            <key>DNS</key>
            <dict>
                <key>ServerAddresses</key>
                <array>
                    <string>192.168.6.97</string>
                    <string>192.168.6.96</string>
                </array>
            </dict>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en3</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Bluetooth PAN</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Bluetooth PAN</string>
        </dict>
        <key>8EF91F03-0D57-497C-804A-520F907E8D91</key>
        <dict>
            <key>DNS</key>
            <dict>
                <key>ServerAddresses</key>
                <array>
                    <string>192.168.6.97</string>
                    <string>192.168.6.96</string>
                </array>
            </dict>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en1</string>
                <key>Hardware</key>
                <string>AirPort</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Wi-Fi</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Wi-Fi</string>
        </dict>
        <key>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</key>
        <dict>
            <key>DNS</key>
            <dict>
                <key>ServerAddresses</key>
                <array>
                    <string>192.168.6.97</string>
                    <string>192.168.6.96</string>
                </array>
            </dict>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>en0</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Ethernet</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Ethernet</string>
        </dict>
        <key>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</key>
        <dict>
            <key>DNS</key>
            <dict>
                <key>ServerAddresses</key>
                <array>
                    <string>192.168.6.97</string>
                    <string>192.168.6.96</string>
                </array>
            </dict>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>fw0</string>
                <key>Hardware</key>
                <string>FireWire</string>
                <key>Type</key>
                <string>FireWire</string>
                <key>UserDefinedName</key>
                <string>FireWire</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>FireWire</string>
        </dict>
        <key>F8317569-4A38-4C57-AA0B-118B86ED464F</key>
        <dict>
            <key>DNS</key>
            <dict>
                <key>ServerAddresses</key>
                <array>
                    <string>192.168.6.97</string>
                    <string>192.168.6.96</string>
                </array>
            </dict>
            <key>IPv4</key>
            <dict>
                <key>ConfigMethod</key>
                <string>DHCP</string>
            </dict>
            <key>IPv6</key>
            <dict>
                <key>ConfigMethod</key>
                <string>Automatic</string>
            </dict>
            <key>Interface</key>
            <dict>
                <key>DeviceName</key>
                <string>bridge0</string>
                <key>Hardware</key>
                <string>Ethernet</string>
                <key>Type</key>
                <string>Ethernet</string>
                <key>UserDefinedName</key>
                <string>Thunderbolt Bridge</string>
            </dict>
            <key>Proxies</key>
            <dict>
                <key>ExceptionsList</key>
                <array>
                    <string>*.local</string>
                    <string>169.254/16</string>
                </array>
                <key>FTPPassive</key>
                <integer>1</integer>
            </dict>
            <key>SMB</key>
            <dict/>
            <key>UserDefinedName</key>
            <string>Thunderbolt Bridge</string>
        </dict>
    </dict>
    <key>Sets</key>
    <dict>
        <key>A3AFD782-9440-4041-9917-4543E586292F</key>
        <dict>
            <key>Network</key>
            <dict>
                <key>Global</key>
                <dict>
                    <key>IPv4</key>
                    <dict>
                        <key>ServiceOrder</key>
                        <array>
                            <string>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</string>
                            <string>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</string>
                            <string>8EF91F03-0D57-497C-804A-520F907E8D91</string>
                            <string>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</string>
                            <string>F8317569-4A38-4C57-AA0B-118B86ED464F</string>
                        </array>
                    </dict>
                </dict>
                <key>Interface</key>
                <dict>
                    <key>en1</key>
                    <dict>
                        <key>AirPort</key>
                        <dict>
                            <key>JoinModeFallback</key>
                            <array>
                                <string>DoNothing</string>
                            </array>
                            <key>PowerEnabled</key>
                            <true/>
                            <key>RememberJoinedNetworks</key>
                            <true/>
                            <key>RequireAdminIBSS</key>
                            <false/>
                            <key>RequireAdminNetworkChange</key>
                            <false/>
                            <key>RequireAdminPowerToggle</key>
                            <false/>
                            <key>Version</key>
                            <integer>2500</integer>
                        </dict>
                    </dict>
                </dict>
                <key>Service</key>
                <dict>
                    <key>4CD8DB21-0AC8-40A5-83C6-094D249CFE68</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/4CD8DB21-0AC8-40A5-83C6-094D249CFE68</string>
                    </dict>
                    <key>8EF91F03-0D57-497C-804A-520F907E8D91</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/8EF91F03-0D57-497C-804A-520F907E8D91</string>
                    </dict>
                    <key>ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/ABC75CBD-33B2-4CD7-AA5C-90C6E745BB71</string>
                    </dict>
                    <key>C0B49A31-0F0A-4BAA-81FF-BAD549404F50</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/C0B49A31-0F0A-4BAA-81FF-BAD549404F50</string>
                    </dict>
                    <key>F8317569-4A38-4C57-AA0B-118B86ED464F</key>
                    <dict>
                        <key>__LINK__</key>
                        <string>/NetworkServices/F8317569-4A38-4C57-AA0B-118B86ED464F</string>
                    </dict>
                </dict>
            </dict>
            <key>UserDefinedName</key>
            <string>Automatic</string>
        </dict>
    </dict>
    <key>VirtualNetworkInterfaces</key>
    <dict>
        <key>Bridge</key>
        <dict>
            <key>bridge0</key>
            <dict>
                <key>Interfaces</key>
                <array>
                    <string>en2</string>
                </array>
                <key>Options</key>
                <dict>
                    <key>__AUTO__</key>
                    <string>thunderbolt-bridge</string>
                </dict>
            </dict>
        </dict>
    </dict>
</dict>
</plist>

Edit 8:

sudo grep -r "192.168.6.97" /Library/Preferences

/Library/Preferences//SystemConfiguration/com.apple.smb.server.plist:       <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
/Library/Preferences//SystemConfiguration/preferences.plist:            <string>192.168.6.97</string>
Binary file /Library/Preferences//com.apple.networkextension.plist matches
grep: /Library/Preferences//com.apple.TimeMachine.plist: Operation not permitted

sudo grep -r "192.168.6.97" ~/Library/Preferences

Binary file /Users/jessepeden/Library/Preferences//com.purevpn.macapp.App.plist matches
grep: /Users/jessepeden/Library/Preferences//com.apple.mail-shared.plist: Operation not permitted
grep: /Users/jessepeden/Library/Preferences//com.apple.homed.notbackedup.plist: Operation not permitted
grep: /Users/jessepeden/Library/Preferences//com.apple.homed.plist: Operation not permitted

Edit 9: The output exceeds the 30,000 character limit on here, so I've put it on PasteBin. com.apple.networkextension.plist

Edit 10:

Just an update. After some back-and-forth with PureVPN's front-line support, I was able to escalate to their macOS developers and get a remote support session going so they could verify the claims about their software being the culprit. They have flagged the issue for remediation in a future release of PureVPN.

OS: macOS 10.14.6 (Mojave)

Hardware: MacBook Pro (Mid 2012)

  • What DNS server addresses do you have? – Melvin Jefferson Jul 24 at 14:38
  • 1
    @MelvinJefferson At work, DHCP assigns 192.168.6.97, and 192.168.6.96; at home, DHCP assigns multiple public DNS servers (such as 1.1.1.1, 1.0.0.1, 75.75.75.75, etc). Obviously that will change if I go to another location (like a coffee shop or hotel). Those assignments, when provided by DHCP, are shown in the Network Preferences/Advanced/DNS tab but are grayed out (to signify they are dynamic). When this bug happens, those addresses are instead shown in black (statically set) and the preferences.plist file also shows they are static rather than saying "DHCP". – Jesse P. Jul 24 at 14:42
  • Have you tried resetting your DNS cache to ensure macOS is using the new DNS server’s records and not cached results from a previous DNS server? – Melvin Jefferson Jul 24 at 14:59
  • @MelvinJefferson That is not relevant to this issue. That would be a solution to an IP address or FQDN resolving incorrectly or to an outdated record. I don't have an issue with resolution (other than macOS trying to use DNS servers because they are being statically set instead of dynamically, that are now unreachable because I'm no longer on the work or home network). – Jesse P. Jul 24 at 15:21
  • Would resetting the DNS cache cause you some problem? No. Try it. Bugs can be weird. – historystamp Jul 24 at 20:05
2

You can find the cause using the Logger, here are several examples [if you need any detailed info], and at the end I show how to use the best 3 combinations for your case (video included):

On the end, using the 3 commands, they monitor in realtime any DNS changes by directly monitoring the system configuration root daemon, also any Network System Configuration FILE changes, and also the root Network Diagnostic sub-system.

You need to keep those 3 commands open in terminal, UNTIL your DNS issue changes happens, and it will be logged.

Keep them running all the time until the issue happens.

These commands will show you Which process/application/network/whatever is causing the changes, and you can monitor it on Realtime, and also query past events to find the past changes.

1) Filter symptonsd messages:

log show --predicate 'subsystem == "com.apple.symptomsd" AND category != "flow"' --info --debug --signpost --style compact

enter image description here

2) Filter messages about DNS (case insensitive)

log show --predicate 'subsystem == "com.apple.symptomsd" AND category != "flow" AND message CONTAINS[cd] "DNS"' --info --debug --signpost --style compact --last 30m

enter image description here

3) Filtrar atraves do System Configuration por alteracoes: log show --predicate 'subsystem == "com.apple.SystemConfiguration" and category !="SCNetworkReachability" ' --info --debug --signpost --style compact --last 30m

enter image description here

4) Filter what is changing DNS system configuration: log show --predicate 'subsystem == "com.apple.SystemConfiguration" and message CONTAINS[cd] "DNS" ' --info --debug --signpost --style compact --last 10m

enter image description here

5) Filter by the Configuration Daemon: log show --predicate 'subsystem == "com.apple.IPConfiguration" ' --info --debug --signpost --style compact --last 10m

enter image description here

6) Filter via interface using CoreUtils -> InterfaceMonitor log show --predicate 'subsystem == "com.apple.CoreUtils" and category == "CUNetInterfaceMonitor" ' --info --debug --signpost --style compact --last 15m

enter image description here

7) Filter via CoreUtils and rapportd log show --predicate 'subsystem == "com.apple.CoreUtils" and process == "rapportd" ' --info --debug --signpost --style compact --start "2019-08-11 14:21:45" --end "2019-08-11 14:22:00"

enter image description here

8) All CoreUtils events at the same time/date interval [as above]: log show --predicate 'subsystem == "com.apple.CoreUtils" ' --info --debug --signpost --style compact --start "2019-08-11 14:21:45" --end "2019-08-11 14:22:00"

enter image description here

9) Filter all events CoreUtils -> System Monitor at the same interval: log show --predicate 'subsystem == "com.apple.CoreUtils" and category == "CUSystemMonitor" ' --info --debug --signpost --style compact --start "2019-08-11 14:21:45" --end "2019-08-11 14:22:00"

enter image description here


The 3 commands DNS Realtime Monitor

I made a video, about using 3 of them. I think they are the best for you and will for sure help you find the reason and when/who/what is changing your MacOS DNS configuration.

Open iTerm with 3 split terminal screens, or open 3 macOS Terminal windows.

Put each command below on each specific terminal window.

Keep them running all the time until the DNS issue happens and your DNS changes. And they will be logged on the 3 terminal windows.

log stream --predicate 'subsystem == "com.apple.IPConfiguration"


log stream --predicate 'subsystem == "com.apple.symptomsd" AND category != "flow" AND message CONTAINS[cd] "DNS"' --info --debug --signpost --style compact


log stream --predicate 'subsystem == "com.apple.SystemConfiguration"  and (message CONTAINS "com.apple.system.config.network_change" OR message CONTAINS "changedKeys") and (message CONTAINS[cd] "DNS") ' --info --debug --signpost --style compact

On the video I am using the 3 commands below on iTerm split window:

Youtube link for the video:

https://youtu.be/yebQH6dEZvU

enter image description here


Temporary helper debug stuff

Contents of an original clean Mojave /Library/Preferences/com.apple.networkextension.plist file


$ defaults read /Library/Preferences/com.apple.networkextension.plist

{
    "$archiver" = NSKeyedArchiver;
    "$objects" =     (
        "$null",
                {
            "$class" = "<CFKeyedArchiverUID 0x7ffbd1402c20 [0x7fff9c6698e0]>{value = 2}";
            "NS.data" = <04000001 00000000 ff560d00 03000000 c90c4f5d 00000000 c1529216 00000000 a5080000 00000000>;
        },
                {
            "$classes" =             (
                NSMutableData,
                NSData,
                NSObject
            );
            "$classname" = NSMutableData;
        }
    );
    "$top" =     {
        SCPreferencesSignature2 = "<CFKeyedArchiverUID 0x7ffbd1402ea0 [0x7fff9c6698e0]>{value = 1}";
        Version = 1;
    };
    "$version" = 100000;
}


  • Comments are not for extended discussion; this conversation has been moved to chat. – Monomeeth Aug 29 at 21:34
  • @Monomeeth I was about to delete it, this was a 3 weeks troubleshooting, also I have yet to edit my answer and cleanup the "debug stuff" space and update some more texts. I will do it on the weekend and make all this clean. – Prado Aug 30 at 21:59
  • Prado, no problems at all. Please don't feel that either of you have done anything wrong here - the fact that there were lots of comments was flagged and I made a choice - one which could have gone either way. I see Jesse P. has raised this on the meta site, so you may want to take a look. – Monomeeth Aug 30 at 23:20
  • @Prado I added a note to to main post (Edit 10) as an update for anyone following this issue. – Jesse P. Sep 5 at 19:15
1

Yeah, this is a tough one without more info:

scutil --dns
dscacheutil -configuration
networksetup -getcurrentlocation
networksetup -listlocations
networksetup -listnetworkserviceorder
networksetup -listallnetworkservices
networksetup -listallhardwareports
networksetup -detectnewhardware
networksetup -getdnsservers [service]

cat /etc/resolv.conf

Would be helpful.

  • The outputs have been added to the question. The "networksetup -getdnsservers" command outputs were all empty, so I left that out. – Jesse P. Aug 9 at 13:30
  • There is something on your results, and may be the cause. The search domain is set as "TCC.local" when it should not include .local on it. Where this setting coming from? My guess: from the DHCP server (?). MacOS cannot have a .local domain assigned via DHCP, because it already uses this special domain for mDNS queries (Bonjour) Multicast DNS which has capabilities of auto configuration, and a behaviour is to ignore DNS config received by DHCP servers. It looks like a conflict situation and it is making your DNS server changes. @JesseP. Can you change that local to any other word? – Prado Aug 10 at 20:38
  • @Prado That has nothing to do with the issue. The search domain (DNS suffix) is solely for short name lookup requests, to assume the FQDN. It is dynamically set via DHCP, not statically set, and is there on ANY connection (including your own). It changes depending on the connection you're using, and can be literally anything (such as .internal, .lan, even real TLDs such as .com, .net, etc.). – Jesse P. Aug 10 at 20:48
  • @JesseP. I know they can be even real TLDs; it can be almost anything, except .local which is reserved for mDNS in RFC 6762. Microsoft, Cisco, Apple, Ubuntu, since years reported DNS conflicts/misconfiguration if the .local was assigned to local/internal network.There is more info at en.wikipedia.org/wiki/.local with references from vendors explicitly warning to never use .local along with misconfiguration problems that can happen. Considering your situation is auto-misconfiguring itself I think it can be related. I'm just trying to add something positive here to help solving it. – Prado Aug 10 at 22:00
  • 1
    @JesseP. Yes, I have very good news and I am sure it will be essencial for you to find and fix this problem, I will post it as an answer here in about 1 hour. – Prado Aug 13 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .