FYI: Manually provided DNS addresses are higher priority than DHCP's

As an FYI to folks here concerned about the issue, manually entered DNS addresses do indeed supercede any provided by DHCP despite what you might be led to believe by the appearance of the Network->Advanced->DNS preference pane.

When you manually enter a DNS server address in Mac OS X Leopard's Network preference pane, the manually entered address(es) appear below any DHCP-provided addresses (which are shown in grey as they are unchangeable), leading one to assume that DHCP-provided addresses always have priority over any a user may specify.

However, a check of the /etc/resolv.conf file generated by Mac OS X shows that in fact user-provided DNS addresses will supercede any provided by DHCP.

As an example, if your router promotes itself as a DHCP server, its IP address, say "192.168.0.253," will appear, greyed out, in the Network->Advanced->DNS preferences pane.

If you then add, say, OpenDNS' addresses of "208.67.222.222" and "208.67.220.220," the preferences window will show:

192.168.0.253 (greyed out)
208.67.222.222
208.67.220.220


But the generated /etc/resolv.conf will show the order Mac OS X will actually reference the servers is:

nameserver 208.67.222.222
nameserver 208.67.220.220
nameserver 192.168.0.253


While this is non-intuitive with respect to how the addresses are displayed in the preference pane, it is exactly the way one would hope things would work - allowing you to specify DNS servers to be used in lieu of any a router provides, especially handy if the router propagates the address of a DNS server that is having issues or is simply overloaded or offline.

Note that as I do not have an unpatched copy of Leopard available, I cannot say if this has always been Mac OS X's behavior or if this ordering was added by Security Update 2008-005.

Regardless, this also means no special modifications are required to try to "turn off" the honoring of DHCP-provided DNS server addresses.

Quad 2.5 GHz G5, 5 GB | 2.33 GHz MBP C2D 2 GB, Mac OS X (10.5.4)

Posted on Aug 12, 2008 6:19 AM

Reply
6 replies

Aug 12, 2008 7:36 AM in response to Topher Kessler

Topher Kessler wrote:
That's good to know. However, users may wish to solely provide their own DNS servers and not have the chance that in case their DNS servers are unreachable they end up using the default one.

that's the problem. there is no way to easily remove the default DHCP provided DNS server. there is [a hack|http://www.macosxhints.com/article.php?story=20080725172011439&query=dns] that has been discussed in several threads but it can break various functions.

I guess one option would be to just add more custom DNS servers to ensure they get used over the default one.

That's the only reasonable thing to do.

Aug 12, 2008 8:01 AM in response to Topher Kessler

If you mean the hack to remove DHCP-provided DNS servers, when you connect to a VPN or some Wi-Fi hot spots they do not allow DNS requests to leave their network but rather have a specific DNS server you must use. This also allows the DNS server to provide local along with Internet DNS service resolution.

If you disable the recognition of DHCP server-provided DNS addresses, when you connect to one of these networks you will have no DNS service at all since your specified DNS servers will be unreachable.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

FYI: Manually provided DNS addresses are higher priority than DHCP's

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.