I've been Googling and even talking to the Apple technical support for days in regards of something that clearly doesn't work in Sonoma (but used to work in Big Sur and Ventura).

The DNS resolver of MacOS seems to completely ignore the DNS server set up by my OpenVPN connection, also the lookup domain. I've checked scutil --dns (preference is alright), and as you can find in many other threads from years ago:

  • ping [internal DNS] -> unknown host
  • dig [internal DNS] -> resolved
  • nslookup [internal DNS] -> resolved

I saw in Google the command ipconfig getpacket en0 | grep -i domain which returns:

$ ipconfig getpacket en0 | grep -i domain
domain_name (string): box
domain_name_server (ip_mult): {,}

That's the DHCP of my home router.

That being said, the VPN connection is properly tunnelling and I can indeed do ping [internal IP] without problem.

The OpenVPN server is running on a Pfsense+ instance, with the nameservers properly set up.

I've looked into dnsmasq and it actually resolves the nameservers, however I find the solution "a bit" dirty and I was wondering if there is anyone with similar experiences but maybe more expertise in DNS configuration that may aid me in this matter?

Thanks a lot!

2 Answers 2


For any other person struggling with Apple's DNS resolving: after struggling for weeks and trying all solutions available on the Internet, VPN / DNS Issues With macOS Ventura on Apple's official forum gave me the key.

Two solutions, you choose:

  • Use DNSmasq as a daemon to replace all DNS resolutions


  • sudo mkdir /etc/resolver
  • Create a file under /etc/resolver/<your domain> (example: /etc/resolver/stackexchange.com) and write in it nameserver [nameserver IP]
  • Then a simple sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder to flush the DNS cache will start resolving your packets :)
  • There is no /etc/resolver on MacOS Sonoma...
    – Chris Dodd
    Jan 18 at 22:53
  • 1
    Create the folder with sudo mkdir /etc/resolver first.
    – Mario
    Jan 19 at 13:17
  • I've edited my comment adding the folder creation :). Thanks for pointing it out!
    – Mario
    Jan 19 at 13:19
  • 1
    FWIW, running dnsmasq works very well.  (At least on versions up to macOS 12 Monterey; haven't yet tried later versions, though I strongly suspect it'll still work.)  You can install it through HomeBrew, autostart it with a LaunchAgent, and specify as the DNS in your network settings.  (OS updates usually blat the network settings, so you have to remember to do that last bit again.)  dnsmasq is powerful and really good at handling a huge list of hostnames, if you want to blackhole adservers, trackers, etc.
    – gidds
    Jan 19 at 15:46
  • I can confirm this works as expected on Macos Sonoma. One note, dig won't show any info about the domain, but a ping command will work as expected.
    – kenjiru
    Feb 15 at 17:34

I had a very similar problem. First of all: dig et.al are not the whole truth on macOS. Many applications (like your browser, for example) use macOS' internal APIs. You can look at your actual DNS configuration by running scutil --dns and resolve a hostname using dns-sd -G v4v6 my-hostname.example.com.

That being said, although scutil showed the seemingly correct DNS configuration (i.e. the VPN's DNS servers), DNS resolution still did not work correctly. Apparently, "iCloud Private Relay" was enabled automatically and inserted another DNS resolver that was invisible to scutil. As soon as I disabled iCloud Private Relay, DNS resolution worked as expected.

  • I actually tried that as well and I didn't get anywhere (even rebooted computer). The solution I posted is extremely weird but does the job in one of the least intrusive ways I've found. Thanks for your reply and the advice!
    – Mario
    Dec 20, 2023 at 4:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .