DNS issues after 10.6.5 update

Note that nslookup directly uses DNS, where Mac OS X normally routes all DNS requests though mDNSResponder.

If you run the following command:

sudo tcpdump -i interface -s 128 port 53

where interface is the network interface you are using, e.g. en0, en1, etc.

What do you see when you try and ping the site?

The server A name is vle. It has multiple aliases (CNAMEs), but in this case I have tried one that is in the same forward lookup zone (streaming) as the A record and one in a different forward lookup zone (www in forward lookup zone vle.me.uk).

PINGING vle

listening on en1, link-type EN10MB (Ethernet), capture size 128 bytes
08:07:16.238144 IP 10.56.71.201.60892 > cse2k301.school.local.domain: 36090+ A? vle.school.local. (50)
08:07:16.241208 IP cse2k301.school.local.domain > 10.56.71.201.60892: 36090* 1/0/0 A 10.56.68.14 (66)
08:07:16.879056 IP 10.56.71.201.65235 > cse2k301.school.local.domain: 40146+ PTR? 15.68.56.10.in-addr.arpa. (42)
08:07:16.880161 IP cse2k301.school.local.domain > 10.56.71.201.65235: 40146* 1/0/0 PTR cse2k301.school.local. (84)
08:07:16.881315 IP 10.56.71.201.52191 > cse2k301.school.local.domain: 31652+ PTR? 201.71.56.10.in-addr.arpa. (43)
08:07:16.882165 IP cse2k301.school.local.domain > 10.56.71.201.52191: 31652 NXDomain 0/0/0 (43)

PINGING vle.school.local

listening on en1, link-type EN10MB (Ethernet), capture size 128 bytes
08:21:41.774175 IP 10.56.71.201.64414 > cse2k301.school.local.domain: 8831+ A? vle.school.local. (50)
08:21:41.775088 IP cse2k301.school.local.domain > 10.56.71.201.64414: 8831* 1/0/0 A 10.56.68.14 (66)
08:21:42.374517 IP 10.56.71.201.53120 > cse2k301.school.local.domain: 18189+ PTR? 15.68.56.10.in-addr.arpa. (42)
08:21:42.375749 IP cse2k301.school.local.domain > 10.56.71.201.53120: 18189* 1/0/0 PTR cse2k301.school.local. (84)
08:21:42.376884 IP 10.56.71.201.61996 > cse2k301.school.local.domain: 60155+ PTR? 201.71.56.10.in-addr.arpa. (43)
08:21:42.386279 IP cse2k301.school.local.domain > 10.56.71.201.61996: 60155 NXDomain* 0/1/0 (93)

PINGING streaming

listening on en1, link-type EN10MB (Ethernet), capture size 128 bytes
08:14:13.033432 IP 10.56.71.201.58453 > cse2k301.school.local.domain: 50225+ A? streaming.school.local. (47)
08:14:13.034235 IP cse2k301.school.local.domain > 10.56.71.201.58453: 50225* 2/0/0 CNAME vle.school.local., A[|domain]
08:14:13.577878 IP 10.56.71.201.63893 > cse2k301.school.local.domain: 35889+ PTR? 15.68.56.10.in-addr.arpa. (42)
08:14:13.578913 IP cse2k301.school.local.domain > 10.56.71.201.63893: 35889* 1/0/0 PTR cse2k301.school.local. (84)
08:14:13.579705 IP 10.56.71.201.51780 > cse2k301.school.local.domain: 60754+ PTR? 201.71.56.10.in-addr.arpa. (43)
08:14:13.580463 IP cse2k301.school.local.domain > 10.56.71.201.51780: 60754 NXDomain 0/1/0 (93)

PINGING www.vle.me.uk

listening on en1, link-type EN10MB (Ethernet), capture size 128 bytes
08:11:45.684188 IP 10.56.71.201.64812 > cse2k301.school.local.domain: 47276+ A? www.vle.me.uk. (40)
08:11:45.686019 IP cse2k301.school.local.domain > 10.56.71.201.64812: 47276* 2/0/0 CNAME vle.school.local.[|domain]
08:11:46.292629 IP 10.56.71.201.60383 > cse2k301.school.local.domain: 44549+ PTR? 15.68.56.10.in-addr.arpa. (42)
08:11:46.293654 IP cse2k301.school.local.domain > 10.56.71.201.60383: 44549* 1/0/0 PTR cse2k301.school.local. (84)
08:11:46.294403 IP 10.56.71.201.57083 > cse2k301.school.local.domain: 7966+ PTR? 201.71.56.10.in-addr.arpa. (43)
08:11:46.295226 IP cse2k301.school.local.domain > 10.56.71.201.57083: 7966 NXDomain 0/0/0 (43)

Ping works fine with vle, vle.school.local and streaming, but I get an error for www.vle.me.uk (ping: cannot resolve www.vle.me.uk: Unknown host).

jadzea wrote:
Ping works fine with vle, vle.school.local and streaming, but I get an error for www.vle.me.uk (ping: cannot resolve www.vle.me.uk: Unknown host).

From the tcpdump output above, everything appears normal; double check to make sure your DNS server(s) are setup according to the following:

http://support.apple.com/kb/HT3473

Obviously this isn't something that should have changed between minor dot releases, but given that most Internet sites use CNAME records it's not a case of CNAME merely being broken per se, but rather some interaction between them and .local domain lookups.

I found this thread looking for clues for my problem also.

Last week I upgraded to 10.6.5 and also included a new apple tv2 in my home network. And I was not sure which one could be the cause of my problem.

I have been having the same problem with my internet access freezing from time to time and the only apparent solution was to reboot my time capsule and the cable modem... and everything would work fine for some more time.


Didn't realize it could be a DNS problem, but that makes sense.

But I also noted that at the same time my internet access drops, my apple tv also refuses to connect to any one of my other macs (itunes home sharing stops working). Can that connection also be impacted by a DNS problem?


All I know is that this is really annoying.

Since upgrading to 10.6.5 I am also having a strange network problem that appears to be with mDNSResponder. Things work at first, and then suddenly Safari gives the "you are not connected to the network" error message. However, I certainly am connected to the network, and tools such as ping, traceroute, and even "host" confirm this. The problem doesn't seem to be the external DNS or network connectivity, since even the "host" command works to resolve names. Furthermore, Firefox works - just not Safari. I think Safari must be linked to a different resolver library than the others, presumably it's linked to the "real" library that Apple thinks you're supposed to be using.

I do see mDNSResponder errors saying "DHCPWakeTime SCDynamicStoreCopyDHCPInfo index 3 failed" which may be related or may be symptoms of an underlying problem.

Everything worked perfectly before the 10.6.5 update; it is definitely the culprit somehow. I know they changed some things for IPv6 in this update and I suspect that's what is ultimately causing the problem somehow.

find the REAL problem http://discussions.info.apple.com/thread.jspa?threadID=2645157&tstart=135 apparently only problem with CNAME

Martin Jaekel1 wrote:
@Canvis : Please explain, as I fail to see the connection.

I do NOT have the problem only with CNAME entries in the DNS. EVERY dns name is no longer resolved. A failed single CNAME resolve should simply time out, not being able to stop the mDNSResonder even contacting the DNS server any more system wide until a reboot.

My problem doesn't seem to have anything to do with CNAME either -- all DNS fails after the trouble starts. For a workaround, I think sending mDNSResponder process any signal will make it start working again, as will disconnecting (e.g. unplugging) the network interface ("network configuration changed"). I don't think you actually have to go so far as rebooting.

cstacy wrote:

Martin Jaekel1 wrote:

EVERY dns name is no longer resolved.

all DNS fails

To reiterate: only in Safari. DNS still works in Firefox, as does "host", "ping", etc.

i am seeing quite similar behavior, namely: after 20-something hours of
everything working, dns resolution simply stops working.

nslookup google.com hangs. ping by name does not work either.
ping by ip address works. existing connections (e.g. ssh session) stay up.
so there is no loss of connectivity.
it does not matter what resolver i use, in general. (e.g. 8.8.8.8 or
the isp's usual router.

renegotiating a dhcp lease does not help.
turning off airport/turning it on again does not help.
dscacheutil --flush makes no difference.

just in case it's helpful to know this:

i applied the upgrade from 10.6.4 to get to 10.6.5. another machine
that got the combo upgrade from 10.6.0 does not yet show this behavior
after 26 hours of uptime. this may not be at all relevant to the problem.

i meant "the isp's usual dns supplied by my router"...