Safari trying to access DNS addresses

Question

Level 1

8 points

Safari trying to access DNS addresses

In the last couple of days everytime I open Safari (5.0.3), LittleSnitch comes up saying Safari wants to access 8.8.8.8 (Google Public DNS) and 208.67.222.222 (OpenDNS) using UDP on port 53.

I've never had this before (Safari should only really be accessing port 80 and 443) as DNS is handled by the OS. My network settings are set to use the router's IP and the router is set to my ISP's DNS servers, so no reason why it should need to use these services.

Does anyone have any ideas why Safari would be behaving like this or are seeing the same thing?

MacBook Pro 15.4" 2.4GHz 2GB RAM nVidia 8600M GT 256MB, Mac OS X (10.5.8), iPhone 3GS 4.2.1 32GB on o2 UK

Posted on Jan 18, 2011 1:51 PM

Reply

Answer 1

andyBall_uk

Level 7

20,516 points

Jan 18, 2011 3:35 PM in response to NickUK

I can't say why it'd be just recently showing - but Safari 5 has dns pre-fetch, unless disabled in Terminal, so on the face of it, Safari contacting dns servers directly doesn't seem so odd.

Are google & opendns ones you used in the past ? - does this persist in a new user account ?
your router is the only number in network-dns ?

Reply

Answer 2

NickUK Author

Level 1

8 points

Jan 19, 2011 11:52 AM in response to andyBall_uk

It's never happened before, so it seems odd to me. I wouldn't have thought the DNS prefetching would have caused it as I've been using Safari for years.

I've also never used the Google or OpenDNS servers. The only IPs listed in the network config are 62.24.128.17 and 62.24.199.23 which are my ISPs DNS servers and come from the DHCP configuration.

I created a new user and it does exactly the same as my account.

Carolyn, I find your answer confusing as LittleSnitch is the one detecting the problem and I don't want to use Google or OpenDNS.

Reply

Answer 3

beckford

Level 1

9 points

Jan 19, 2011 8:35 PM in response to Carolyn Samit

I'm sorry but that makes no sense. You are saying solve the problem by uninstalling the tool that found it?

Anyway:

networksetup -getdnsservers AirPort will tell you where osX is looking for dns.

scutil --dns will tell you something as well.

The Snitch is your friend. So is ipfw, albeit a rather taciturn and irritable one. I'd suggest making sure any DNS packets go out the way you decide.

Reply

Answer 4

Jan 18, 2011 3:22 PM in response to NickUK

Hi,

Little Snitch is most likely the problem.

Run the uninstaller here http://www.obdev.at/technotes/uninstall-little-snitch.html

Then restart your Mac, launch Safari.

If you want to avoid browser re directs by your ISP you can use Google's DNS, but you may find Open DNS has better security, it's free, and offers anti phishing filters.

http://www.opendns.com/start

Click: Free / Basic

Carolyn 🙂

Reply

Answer 5

andyBall_uk

Level 7

20,516 points

Jan 19, 2011 12:53 PM in response to NickUK

odd - even with prefetch on, a tcpdump shows only the chosen dns server here -
what happens if you replace yours with say a BT one ? - 194.72.9.34 which should work regardless of your isp, whose servers I can't test, since presumably they block non-Opal punters.

Reply

Answer 6

andyBall_uk

Level 7

20,516 points

Jan 19, 2011 12:57 PM in response to andyBall_uk

oh, and you might usefully double-check (briefly) with tcpdump; only because on another board here someone mentioned LS returning unexpected host names from Software Update ip's.

Reply

Answer 7

NickUK Author

Level 1

8 points

Jan 20, 2011 11:13 AM in response to NickUK

Thanks for your responses.

I've installed Wireshark to see what Safari was actually querying those IPs for and it appears it's looking up www.google.com but everything else uses my router for DNS queries.

I've got www.google.co.uk in my Top Sites but that's looked up using the router.

If this is correct, why would Safari use 8.8.8.8 and 208.67.222.222 to lookup www.google.com twice?

Reply

Answer 8

_11220_

Level 1

14 points

Jan 21, 2011 11:11 AM in response to NickUK

Hey Nick - you manage to get to the bottom of this? I'm having the same problem. Weird. . .

Reply

Answer 9

NickUK Author

Level 1

8 points

Jan 23, 2011 5:59 AM in response to _11220_

11220 do you have Rapport installed? It's a security program which many banks provide.

I've got a feeling Rapport might be causing this as Firefox does it too (it installs in Safari and Firefox) but Opera and Chrome don't. There's an option in Rapport that says about protecting against phishing and malware web sites (both Google Public DNS and OpenDNS do this). I've disabled that option but it still does it, so I'm unsure.

It's hard to diagnose because it's not every startup...

Reply

Answer 10

_11220_

Level 1

14 points

Jan 23, 2011 12:09 PM in response to NickUK

Hey Nick

As it goes I do have Rapport installed.

Also I didn't realise it wasn't happening every startup as until this time round when the message didn't pop up. . .

Reply