mDNSResponder polls ISP DNS every 1 or 2 seconds

Question

mDNSResponder polls ISP DNS every 1 or 2 seconds

Since I updated to 10.5.5 and after about two or three hours of work a day, mDNSResponder tries to connect to our Internet Service Providers DNS very often. A restart seems to help for about two or three hours again.
There are no problems using Mail or Safari, everything works just fine. I don't even understand why mDNSResponder tries to connect an external DNS. We use an internal 10.5. Server with DNS. All Machines are configured to use DHCP, no manual configuration at all. I triple checked that each Mac gets two IPs for DNS calls: Primary our internal DNS and secondary our Routers IP configured for DNS relaying. I did restart both, server and router. But no success.

Any suggestions or anybody with same "problem"?

TIA
Bernd

iMac 2.4GHZ 24", Mac OS X (10.5.5)

Posted on Oct 2, 2008 4:10 AM

Reply

Answer 1

baltwo

Level 9

62,386 points

Oct 2, 2008 11:14 AM in response to Bernd Luenenschloss

I really don't know what's going on, but System Preferences->Network->and see what's showing up in the DNS servers box. You might have to reconfigure, but that's a server issue best solved at the server products forums.

Reply

Answer 2

Oct 2, 2008 11:42 AM in response to baltwo

As I said before: I triple checked Network Settings.
Everything is as it should be.
There is nothing to reconfigure when using DHCP.
And nothing changed, just updated to from 10.5.4 to 10.5.5.

I think the culprit is a new mDNSResponder that came with 10.5.5 Update or with the latest Security Update.

Reply

Answer 3

orangekay

Level 5

4,085 points

Oct 2, 2008 11:42 AM in response to Bernd Luenenschloss

Define "tries to connect." What port is it opening, what is it sending, etc.

Reply

Answer 4

Snoop Dogg

Level 4

1,502 points

Oct 3, 2008 1:52 PM in response to Bernd Luenenschloss

You can enable mDNSResponder packet logging by doing the following in Terminal...

*sudo killall -USR2 mDNSResponder*

Then open system.log using the Console application and you'll see the mDNSResponder packets. What do they look like?

Reply

Answer 5

Oct 4, 2008 4:45 AM in response to Snoop Dogg

Thanks for your advice.
I'll try this and report afterwards.

Bernd

Reply

Answer 6

Oct 4, 2008 11:10 AM in response to Snoop Dogg

I did what I was told to do 😉
And this is what I get:

Oct 4 15:37:58 im7 mDNSResponder[16]: -- Sent UDP DNS Query (flags 0100) RCODE: NoErr (0) RD ID: 7193 43 bytes from port 50627 to 192.168.1.250:53 --
Oct 4 15:37:58 im7 mDNSResponder[16]: 1 Questions
Oct 4 15:37:58 im7 mDNSResponder[16]: 0 lb. dns-sd.udp.mydomain.com. PTR
Oct 4 15:37:58 im7 mDNSResponder[16]: 0 Answers
Oct 4 15:37:58 im7 mDNSResponder[16]: 0 Authorities
Oct 4 15:37:58 im7 mDNSResponder[16]: 0 Additionals
Oct 4 15:37:58 im7 mDNSResponder[16]: --------------
Oct 4 15:37:58 im7 mDNSResponder[16]: -- Received UDP DNS Response (flags 8583) RCODE: NXDomain (3) AA RD RA ID: 7193 116 bytes from 192.168.1.250:53 to 192.168.1.24:50627 --
Oct 4 15:37:58 im7 mDNSResponder[16]: 1 Questions
Oct 4 15:37:58 im7 mDNSResponder[16]: 0 lb. dns-sd.udp.mydomain.com. PTR
Oct 4 15:37:58 im7 mDNSResponder[16]: 0 Answers
Oct 4 15:37:58 im7 mDNSResponder[16]: 1 Authorities
Oct 4 15:37:58 im7 mDNSResponder[16]: 0 TTL 10800 103 mydomain.com. SOA x5server.mydomain.com. admin.mydomain.com.mydomain.com. 200
Oct 4 15:37:58 im7 mDNSResponder[16]: 0 Additionals
Oct 4 15:37:58 im7 mDNSResponder[16]: --------------
Oct 4 16:19:31 im7 login[178]: DEAD_PROCESS: 178 ttys000
Oct 4 16:20:07 im7 /usr/sbin/ocspd[434]: starting
Oct 4 16:27:01 im7 mDNSResponder[16]: -- Sent UDP DNS Query (flags 0100) RCODE: NoErr (0) RD ID: 17932 31 bytes from port 57646 to 192.168.1.1:53 --
Oct 4 16:27:01 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:27:01 im7 mDNSResponder[16]: 0 24.1.168.192.in-addr.arpa. PTR
Oct 4 16:27:01 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:27:01 im7 mDNSResponder[16]: 0 Authorities
Oct 4 16:27:01 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:27:01 im7 mDNSResponder[16]: --------------
Oct 4 16:27:01 im7 mDNSResponder[16]: -- Received UDP DNS Response (flags 8583) RCODE: NXDomain (3) AA RD RA ID: 17932 32 bytes from 192.168.1.1:53 to 192.168.1.24:57646 --
Oct 4 16:27:01 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:27:01 im7 mDNSResponder[16]: 0 24.1.168.192.in-addr.arpa. PTR
Oct 4 16:27:01 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:27:01 im7 mDNSResponder[16]: 0 Authorities
Oct 4 16:27:01 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:27:01 im7 mDNSResponder[16]: --------------

*** till here no problems, polls about every hour ***

*** Backup Time... ***

Oct 4 16:27:03 im7 kernel[0]: AFP_VFS afpfs_mount: /Volumes/backup, pid 442
Oct 4 16:27:03 im7 /System/Library/CoreServices/backupd[446]: Starting standard backup
Oct 4 16:27:03 im7 /System/Library/CoreServices/backupd[446]: Network volume mounted at: /Volumes/backup
Oct 4 16:27:03 im7 hdiejectd[452]: running
Oct 4 16:27:04 im7 /System/Library/CoreServices/backupd[446]: Disk image /Volumes/backup/im7_001ff34e4dc7.sparsebundle mounted at: /Volumes/Backup of im7
Oct 4 16:27:04 im7 /System/Library/CoreServices/backupd[446]: Backing up to: /Volumes/Backup of im7/Backups.backupdb
Oct 4 16:27:06 im7 /System/Library/CoreServices/backupd[446]: No pre-backup thinning needed: 772.3 MB requested (including padding), 16.82 GB available
Oct 4 16:27:06 im7 /System/Library/CoreServices/backupd[446]: Waiting for index to be ready (906 > 0)
Oct 4 16:27:36: --- last message repeated 1 time ---
Oct 4 16:27:40 im7 /System/Library/CoreServices/backupd[446]: Copied 350 files (201 KB) from volume iMac HD.
Oct 4 16:27:41 im7 /System/Library/CoreServices/backupd[446]: No pre-backup thinning needed: 772.1 MB requested (including padding), 16.82 GB available
Oct 4 16:27:50 im7 /System/Library/CoreServices/backupd[446]: Copied 59 files (816 bytes) from volume iMac HD.
Oct 4 16:27:51 im7 /System/Library/CoreServices/backupd[446]: Starting post-backup thinning
Oct 4 16:27:51 im7 /System/Library/CoreServices/backupd[446]: No post-back up thinning needed: no expired backups exist
Oct 4 16:27:51 im7 /System/Library/CoreServices/backupd[446]: Backup completed successfully.
Oct 4 16:27:55 im7 /System/Library/CoreServices/backupd[446]: Ejected Time Machine disk image.
Oct 4 16:27:55 im7 kernel[0]: AFP_VFS afpfs_unmount: /Volumes/backup, flags 0, pid 467
Oct 4 16:27:55 im7 /System/Library/CoreServices/backupd[446]: Ejected Time Machine network volume.

*** Backup done ***

*** Here we are, polling about every minute ***

Oct 4 16:29:03 im7 com.apple.launchd[1] (com.apple.netauth.sysagent[442]): Stray process with PGID equal to this dead job: PID 445 PPID 1 check_afp
Oct 4 16:37:58 im7 mDNSResponder[16]: -- Sent UDP DNS Query (flags 0100) RCODE: NoErr (0) RD ID: 5869 49 bytes from port 52562 to 192.168.1.1:53 --
Oct 4 16:37:58 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:37:58 im7 mDNSResponder[16]: 0 1.0.0.127.dnsbugtest.1.0.0.127.in-addr.arpa. PTR
Oct 4 16:37:58 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:37:58 im7 mDNSResponder[16]: 0 Authorities
Oct 4 16:37:58 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:37:58 im7 mDNSResponder[16]: --------------
Oct 4 16:37:58 im7 mDNSResponder[16]: -- Received UDP DNS Response (flags 8583) RCODE: NXDomain (3) AA RD RA ID: 5869 49 bytes from 62.220.18.8:53 to 192.168.1.24:52562 --
Oct 4 16:37:58 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:37:58 im7 mDNSResponder[16]: 0 1.0.0.127.dnsbugtest.1.0.0.127.in-addr.arpa. PTR
Oct 4 16:37:58 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:37:58 im7 mDNSResponder[16]: 0 Authorities
Oct 4 16:37:58 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:37:58 im7 mDNSResponder[16]: --------------
Oct 4 16:38:07 im7 mDNSResponder[16]: -- Sent UDP DNS Query (flags 0100) RCODE: NoErr (0) RD ID: 5869 45 bytes from port 52562 to 192.168.1.250:53 --
Oct 4 16:38:07 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 b. dns-sd.udp.0.1.168.192.in-addr.arpa. PTR
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 Authorities
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:38:07 im7 mDNSResponder[16]: --------------
Oct 4 16:38:07 im7 mDNSResponder[16]: -- Received UDP DNS Response (flags 8583) RCODE: NXDomain (3) AA RD RA ID: 5869 139 bytes from 192.168.1.250:53 to 192.168.1.24:52562 --
Oct 4 16:38:07 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 b. dns-sd.udp.0.1.168.192.in-addr.arpa. PTR
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:38:07 im7 mDNSResponder[16]: 1 Authorities
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 TTL 10800 104 1.168.192.in-addr.arpa. SOA x5server.mydomain.com. admin.mydomain.com.1.168.192.in-addr.arpa. 2
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:38:07 im7 mDNSResponder[16]: --------------
Oct 4 16:38:07 im7 mDNSResponder[16]: -- Sent UDP DNS Query (flags 0100) RCODE: NoErr (0) RD ID: 41475 49 bytes from port 51222 to 192.168.1.1:53 --
Oct 4 16:38:07 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 1.0.0.127.dnsbugtest.1.0.0.127.in-addr.arpa. PTR
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 Authorities
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:38:07 im7 mDNSResponder[16]: --------------
Oct 4 16:38:07 im7 mDNSResponder[16]: -- Received UDP DNS Response (flags 8583) RCODE: NXDomain (3) AA RD RA ID: 41475 49 bytes from 62.220.18.8:53 to 192.168.1.24:51222 --
Oct 4 16:38:07 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 1.0.0.127.dnsbugtest.1.0.0.127.in-addr.arpa. PTR
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 Authorities
Oct 4 16:38:07 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:38:07 im7 mDNSResponder[16]: --------------
Oct 4 16:38:10 im7 mDNSResponder[16]: -- Sent UDP DNS Query (flags 0100) RCODE: NoErr (0) RD ID: 41475 46 bytes from port 51222 to 192.168.1.250:53 --
Oct 4 16:38:10 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:38:10 im7 mDNSResponder[16]: 0 db. dns-sd.udp.0.1.168.192.in-addr.arpa. PTR
Oct 4 16:38:10 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:38:10 im7 mDNSResponder[16]: 0 Authorities
Oct 4 16:38:10 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:38:10 im7 mDNSResponder[16]: --------------
Oct 4 16:38:10 im7 mDNSResponder[16]: -- Received UDP DNS Response (flags 8583) RCODE: NXDomain (3) AA RD RA ID: 41475 140 bytes from 192.168.1.250:53 to 192.168.1.24:51222 --
Oct 4 16:38:10 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:38:10 im7 mDNSResponder[16]: 0 db. dns-sd.udp.0.1.168.192.in-addr.arpa. PTR
Oct 4 16:38:10 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:38:10 im7 mDNSResponder[16]: 1 Authorities
Oct 4 16:38:10 im7 mDNSResponder[16]: 0 TTL 10800 104 1.168.192.in-addr.arpa. SOA x5server.mydomain.com. admin.mydomain.com.1.168.192.in-addr.arpa. 2
Oct 4 16:38:10 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:38:10 im7 mDNSResponder[16]: --------------
Oct 4 16:38:13 im7 mDNSResponder[16]: -- Sent UDP DNS Query (flags 0100) RCODE: NoErr (0) RD ID: 41475 46 bytes from port 51222 to 192.168.1.250:53 --
Oct 4 16:38:13 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:38:13 im7 mDNSResponder[16]: 0 db. dns-sd.udp.0.1.168.192.in-addr.arpa. PTR
Oct 4 16:38:13 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:38:13 im7 mDNSResponder[16]: 0 Authorities
Oct 4 16:38:13 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:38:13 im7 mDNSResponder[16]: --------------
Oct 4 16:38:13 im7 mDNSResponder[16]: -- Received UDP DNS Response (flags 8583) RCODE: NXDomain (3) AA RD RA ID: 41475 140 bytes from 192.168.1.250:53 to 192.168.1.24:51222 --
Oct 4 16:38:13 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:38:13 im7 mDNSResponder[16]: 0 db. dns-sd.udp.0.1.168.192.in-addr.arpa. PTR
Oct 4 16:38:13 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:38:13 im7 mDNSResponder[16]: 1 Authorities
Oct 4 16:38:13 im7 mDNSResponder[16]: 0 TTL 10800 104 1.168.192.in-addr.arpa. SOA x5server.mydomain.com. admin.mydomain.com.1.168.192.in-addr.arpa. 2
Oct 4 16:38:13 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:38:13 im7 mDNSResponder[16]: --------------
Oct 4 16:38:16 im7 mDNSResponder[16]: -- Sent UDP DNS Query (flags 0100) RCODE: NoErr (0) RD ID: 5869 45 bytes from port 52562 to 192.168.1.250:53 --
Oct 4 16:38:16 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:38:16 im7 mDNSResponder[16]: 0 b. dns-sd.udp.0.1.168.192.in-addr.arpa. PTR
Oct 4 16:38:16 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:38:16 im7 mDNSResponder[16]: 0 Authorities
Oct 4 16:38:16 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:38:16 im7 mDNSResponder[16]: --------------
Oct 4 16:38:16 im7 mDNSResponder[16]: -- Received UDP DNS Response (flags 8583) RCODE: NXDomain (3) AA RD RA ID: 5869 139 bytes from 192.168.1.250:53 to 192.168.1.24:52562 --
Oct 4 16:38:16 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:38:16 im7 mDNSResponder[16]: 0 b. dns-sd.udp.0.1.168.192.in-addr.arpa. PTR
Oct 4 16:38:16 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:38:16 im7 mDNSResponder[16]: 1 Authorities
Oct 4 16:38:16 im7 mDNSResponder[16]: 0 TTL 10800 104 1.168.192.in-addr.arpa. SOA x5server.mydomain.com. admin.mydomain.com.1.168.192.in-addr.arpa. 2
Oct 4 16:38:16 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:38:16 im7 mDNSResponder[16]: --------------
Oct 4 16:38:22 im7 mDNSResponder[16]: -- Sent UDP DNS Query (flags 0100) RCODE: NoErr (0) RD ID: 41475 49 bytes from port 51222 to 192.168.1.1:53 --
Oct 4 16:38:22 im7 mDNSResponder[16]: 1 Questions
Oct 4 16:38:22 im7 mDNSResponder[16]: 0 1.0.0.127.dnsbugtest.1.0.0.127.in-addr.arpa. PTR
Oct 4 16:38:22 im7 mDNSResponder[16]: 0 Answers
Oct 4 16:38:22 im7 mDNSResponder[16]: 0 Authorities
Oct 4 16:38:22 im7 mDNSResponder[16]: 0 Additionals
Oct 4 16:38:22 im7 mDNSResponder[16]: --------------

What does that "dnsbugtest" mean?

x5server is at 192.168.1.250 (server)
im7 is at 192.168.1.24 (DHCP client)

I would appreciate any hints
Bernd

Message was edited by: Bernd Luenenschloss

Reply

Answer 7

Snoop Dogg

Level 4

1,502 points

Oct 4, 2008 12:23 PM in response to Bernd Luenenschloss

OK, it looks like the DNS proxy in your router is responding with the wrong IP address. It should be responding with source IP address 192.168.1.1, but instead it's responding with source IP address 62.220.18.8. I answered this once before.

http://discussions.apple.com/thread.jspa?threadID=1422531

You can work around this issue by bypassing the buggy DNS proxy in your router. Just add 62.220.18.8 to your list of DNS servers in the Network pref pane.

Reply

Answer 8

Oct 7, 2008 7:30 AM in response to Snoop Dogg

Yes, that's it!
In fact we are using a DrayTek Vigor 2200VG, I removed the secondary DNS entry pointing to this router.
Unusual polls vanished - Thank you very much!

Bernd

Reply

Answer 9

baltwo

Level 9

62,386 points

Oct 7, 2008 12:12 PM in response to Bernd Luenenschloss

Thanks for the feedback. Good computing.

Reply