Mac resolves specific domains to 127.x.x.x IPs without sending the DNS queries

I noticed my mac can't resolve some domains (domains are publicly resolvable, but you need to be in org's VPN to reach the IPs). More accurately, it incorrectly resolves them to an IP in the 127.0.0.0/8 range; a different IP each time. The domains should resolve to a specific IP in the 10.0.0.0/8 range, this works for everyone except me on this specific device (mac m1 pro running 13.6.2 with an Apple Silicon CPU).


I tried many different DNS servers (1.1.1.1, 8.8.8.8, among others) using dig:

dig my.domain @1.1.1.1

and none of them worked. I checked with Wireshark and I see no outbound DNS queries (which I do for other domains). It is worth noting that the dig output shows a warning:

# dig my.domain @1.1.1.1
;; Warning: Message parser reports malformed message packet.

; <<>> DiG 9.10.6 <<>> my.domain @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9394
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;my.domain.	IN	A

;; ANSWER SECTION:
my.domain. 15	IN	A	127.250.53.69

;; Query time: 3 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Mon Jan 15 14:12:55 -03 2024
;; MSG SIZE  rcvd: 57

The TTL mentioned in the response is also not respected, when I run successive requests they resolve to different IPs.


I tried flushing my local DNS cache but nothing changes. I confirmed that I successfully flushed the cache by seeing outbound queries for domains that were cached (for which I couldn't see any outbound queries before flushing). I ran these commands as root to flush it:

dscacheutil -flushcache; sudo killall -HUP mDNSResponder


I also tried disabling mDNS but all processes that use my device's resolver (browsers, dns-sd, etc.) stopped resolving any domains. With mDNS disabled, the same troublesome domains kept resolving to 127.x.x.x addresses.

MacBook Pro 14″, macOS 13.6

Posted on Jan 15, 2024 9:24 AM

Reply
Question marked as Top-ranking reply

Posted on Jan 16, 2024 6:09 AM

I disabled the EDR (SentinelOne) and the issue is gone. IT says that SentinelOne doesn't do any DNS filtering ¯\_(ツ)_/¯

Similar questions

1 reply

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Mac resolves specific domains to 127.x.x.x IPs without sending the DNS queries

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.