Frustrating DNS problem - works with Chrome, not with Safari

Question

Frustrating DNS problem - works with Chrome, not with Safari

Hello --

I use a paid DNS service that is authenticated by my IP address. In my network settings, I add the IP address of this DNS server, and it works fine in Chrome.

My DNS list looks like this:

[custom DNS IP]

192.168.1.1

Chrome uses the custom DNS with no problems -- I know this because this DNS service allows me to view certain streaming sites here in Germany, and it works fine.

However, when I use Safari, it's not using the custom DNS. (There is a test page to confirm that it is working.) It is using my ISP's default DNS, which I gather it is getting via the gateway 192.168.1.1.

If I remove 192.168.1.1 from my DNS list, Safari cannot resolve ANY name -- apple.com, google.com, etc. Nothing at all.

Why is that? Why won't Safari simply use the custom DNS, as Chrome does?

I have tried flushing the DNS cache, deleted all Safari temp data, flushed the Safari cache -- but no change.

Safari will only resolve sites if I re-add 192.168.1.1 to my DNS list.

Very frustrated -- any ideas?

MacBook Pro, OS X Yosemite (10.10.5)

Posted on Sep 8, 2015 2:40 AM

Reply

Answer 1

Linc Davis

Level 10

209,739 points

Sep 8, 2015 12:15 PM in response to CuriousInBerlin

Please read this whole message before doing anything.

This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.

The purpose of the test is to determine whether the problem is caused by third-party software that loads automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.

Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem.

Note: If FileVault is enabled in OS X 10.9 or earlier, or if a firmware password is set, or if the startup volume is a software RAID, you can’t do this. Ask for further instructions.

Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.

The login screen appears even if you usually login automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.

Test while in safe mode. Same problem?

After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of the test.

Reply

Answer 2

Linc Davis

Level 10

209,739 points

Sep 9, 2015 6:43 AM in response to CuriousInBerlin

I meant that I would be looking for a new router. But if you want to try to make it work, compare its settings to Apple's recommendations. Some third-party routers may be not be reliable in mixed 802.11b/g/n/ac radio mode. Try setting the mode to one of those only. More advanced configuration changes you could try on some routers are changing the encryption algorithm from TKIP to TKIP/AES or AES, and/or changing the Group Key Interval from 900 to 3200. I can't tell you specifically how to make those changes, because all routers are different. Refer to the manufacturer's documentation.

Reply

Answer 3

Sep 8, 2015 11:24 AM in response to Linc Davis

It's not openDNS, and no, I've not installed any software.

I suspect the issue has something to do with "Search Domains". At home, I noticed that there is an entry "localdomain", which does not appear when I connect to my network at my office.

However, even if I remove it at home, Safari still will not resolve any site unless 192.168.1.1 is in the DNS list. Desperate to understand why it's working this way...

Reply

Answer 4

Sep 8, 2015 11:51 AM in response to CuriousInBerlin

I forgot to mention, at my office, there was no problem Safari and Chrome both were functioning properly.

It's only at home that I have the problem. When I check using IPLeak.net, it tells me I'm using my ISPs DNS server, even though I don't have that address in my DNS list. It is simply ignoring the other entries (which are first in the list) and just using (I assume) the 192.168.1.1 gateway....

Reply

Answer 5

Sep 8, 2015 2:11 PM in response to Linc Davis

First off, let me just say thank you for helping me troubleshoot this problem.

I did the steps you outlined above, and even in Safe mode, the behavior was identical. Chrome worked, Safari did not. Tests run at ipleak.net yielded the same results as before. I guess this rules out any add-ons, plug-ins, or extensions.

Is there no way to force Safari to use the DNS servers in the order they appear? From a terminal window, I ran scutil --dns, and it gave me the following at the end: (I XXd out part of the IP of the DNS server)

DNS configuration (for scoped queries)

resolver #1

search domain[0] : localdomain

nameserver[0] : 82.XXX.XX.XX

nameserver[1] : 192.168.1.1

if_index : 5 (en1)

flags : Scoped, Request A records

reach : Reachable

Removing the search domain changes nothing.

I have tried scouring google for a clue, but I can find nothing.

EDIT: One additional piece of information -- when I connect to my router directly via ethernet cable, it works fine. So, something is introduced via WiFi that causes it to ignore the DNS settings?

Reply

Answer 6

Linc Davis

Level 10

209,739 points

Sep 8, 2015 3:08 PM in response to CuriousInBerlin

Safari does use the system DNS settings. Are you sure those settings are the same for Wi-Fi and Ethernet? If they are, you're apparently dealing with some kind of strange networking problem. Do you have the same problem on the work network?

Reply

Answer 7

Sep 8, 2015 3:34 PM in response to Linc Davis

On ethernet, there's no need for a 192.168.1.1 in the DNS list -- Safari works fine, and uses the proper DNS.

It's only on WiFi that the 192.168.1.1 is needed. Without it, Safari can't resolve any addresses. But again, even though it's at the bottom of the list, it seems to be what's being used in Safari (based on the results of IPleak.net)

The network at work is a different ISP, and everything worked fine there.

Reply

Answer 8

Linc Davis

Level 10

209,739 points

Sep 8, 2015 3:40 PM in response to CuriousInBerlin

From the menu bar, select

 ▹ System Preferences ▹ Network

If the Network preference pane is locked, click the lock icon in the lower left corner and enter your password to unlock it. Then click the Advanced button and select the Hardware tab. Select

Configure: Manually

and

MTU: Custom

Enter an MTU value of 1280.

Click OK and then Apply. Test.

You must apply the change before it takes effect.

If the issue is resolved, experiment with higher MTU values until you find the highest one that works. The higher the MTU, the better the network interface will perform.

If changing the MTU has no effect, restore the Configure setting to Automatically.

Reply

Answer 9

Sep 8, 2015 5:08 PM in response to Linc Davis

That had no effect. Even tried several numbers in the range.

I decided to take a look at the console, to see if there were any obvious messages there.

Here are the differences between 1) starting Safari with 192.168.1.1 in the DNS list and 2) starting Safari without it in the DNS list. Most obvious difference is that when it is not present, configd sets a hostname....

I searched through the console messages for other things from configd, and I've pasted those below as well.

STARTUP SAFARI WITH 192.168.1.1 IN DNS LIST

9/9/15 01:53:35.581 storeaccountd[470]: AccountServiceDelegate: Accepting new connection <NSXPCConnection: 0x7fe189d03e10> connection from pid 3250 with interface <AccountServiceInterface: 0x7fe189e42070> (PID 3250)

9/9/15 01:53:35.734 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

9/9/15 01:53:36.384 locationd[225]: Couldn't find a requirement string for masquerading client /System/Library/PrivateFrameworks/Parsec.framework

9/9/15 01:53:36.385 locationd[225]: could not get apple languages array, assuming english

9/9/15 01:53:37.358 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

9/9/15 01:53:37.359 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

9/9/15 01:53:37.405 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

9/9/15 01:54:56.767 locationd[225]: Location icon should now be in state 'Active'

9/9/15 01:54:56.864 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

9/9/15 01:54:58.314 locationd[225]: NETWORK: requery, 0, 0, 0, 0, 16, items, fQueryRetries, 0, fLastRetryTimestamp, 463449008.6

9/9/15 01:54:58.857 locationd[225]: Location icon should now be in state 'Region Monitoring'

9/9/15 01:55:08.404 com.apple.xpc.launchd[1]: (com.apple.auditd[3262]) Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.auditd

9/9/15 01:55:08.829 lsuseractivityd[388]: -[LSUserActivityClientProcess doUpdateUserActivityInfo:makeCurrent:completionHandler:], refusing to register user activity from client, and returning error Error Domain=LSContinuityErrorDomain Code=-108 "The operation couldn’t be completed. (LSContinuityErrorDomain error -108.)" for item <__NSConcreteUUID 0x7f8b78c248c0> 6E2FB4B1-EC0D-4203-9872-F6480A94D086 NSUserActivityTypeBrowsingWeb (LSUserActivityClientProcess.m #1148)

9/9/15 01:55:10.990 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

9/9/15 01:57:04.717 com.apple.SecurityServer[87]: Session 100202 created

9/9/15 01:57:05.099 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

9/9/15 01:58:10.737 com.apple.WebKit.WebContent[3271]: BUG in libdispatch: 14F27 - 2943 - 0x4

9/9/15 01:58:10.744 com.apple.xpc.launchd[1]: (com.apple.WebKit.WebContent.01B7E0A3-88FA-4A1B-B212-89E7DE0801B4[3271]) Service exited with abnormal code: 1

9/9/15 01:58:11.765 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

STARTUP SAFARI WITHOUT 192.168.1.1 IN DNS LIST

9/9/15 01:37:23.421 storeaccountd[470]: AccountServiceDelegate: Accepting new connection <NSXPCConnection: 0x7fe189c8ec10> connection from pid 3139 with interface <AccountServiceInterface: 0x7fe189ca8c90> (PID 3139)

9/9/15 01:37:23.507 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

9/9/15 01:37:23.871 locationd[225]: Couldn't find a requirement string for masquerading client /System/Library/PrivateFrameworks/Parsec.framework

9/9/15 01:37:23.871 locationd[225]: could not get apple languages array, assuming english

9/9/15 01:37:24.066 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

9/9/15 01:37:24.943 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

9/9/15 01:37:24.945 com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.

9/9/15 01:37:44.070 configd[54]: setting hostname to "Andrews-MacBook-Pro.local"

9/9/15 01:37:44.269 digest-service[3149]: label: default

9/9/15 01:37:44.269 digest-service[3149]: dbname: od:/Local/Default

9/9/15 01:37:44.269 digest-service[3149]: mkey_file: /var/db/krb5kdc/m-key

9/9/15 01:37:44.269 digest-service[3149]: acl_file: /var/db/krb5kdc/kadmind.acl

9/9/15 01:37:44.305 digest-service[3149]: digest-request: uid=0

9/9/15 01:37:44.375 digest-service[3149]: digest-request: netr probe 0

9/9/15 01:37:44.376 digest-service[3149]: digest-request: init request

9/9/15 01:37:44.386 digest-service[3149]: digest-request: init return domain: ANDREWS-MBP server: ANDREWS-MACBOOK-PRO indomain was: <NULL>

9/9/15 01:37:44.492 digest-service[3149]: digest-request: uid=0

9/9/15 01:37:44.493 digest-service[3149]: digest-request: init request

9/9/15 01:37:44.497 digest-service[3149]: digest-request: init return domain: MACBOOKPRO-687A server: ANDREWS-MACBOOK-PRO indomain was: <NULL>

CONFIGD MESSAGES

9/9/15 01:22:36.819 configd[54]: network changed: v4(en1:192.168.1.3) DNS! Proxy SMB

9/9/15 01:26:34.218 configd[54]: network changed: v4(en1:192.168.1.3) DNS! Proxy SMB

9/9/15 01:27:04.288 configd[54]: setting hostname to "Andrews-MacBook-Pro.local"

9/9/15 01:32:24.361 configd[54]: network changed: v4(en1:192.168.1.3) DNS! Proxy SMB

9/9/15 01:32:40.687 configd[54]: setting hostname to "Andrews-MBP"

9/9/15 01:37:14.011 configd[54]: network changed: v4(en1:192.168.1.3) DNS! Proxy SMB

9/9/15 01:37:44.070 configd[54]: setting hostname to "Andrews-MacBook-Pro.local"

9/9/15 01:49:47.864 configd[54]: network changed: v4(en1:192.168.1.3) DNS! Proxy SMB

9/9/15 01:50:04.396 configd[54]: setting hostname to "Andrews-MBP

Reply

Answer 10

Sep 9, 2015 1:32 AM in response to Linc Davis

Also -- what do you mean by primary DNS server? I don't see that in the log.

If Chrome was also not working, then I would think it was indeed a router issue. But Chrome works fine without my gateway needed in the DNS list.

Is it something to do with mDNSResponder perhaps?

Reply

Answer 11

Sep 9, 2015 1:59 AM in response to Linc Davis

Sorry one last thing:

And one additional observation -- Safari won't even open a page if I enter an IP (apple: 17.172.224.47). With no name to resolve, why is it still failing to open the site? Again, this is only fixed if I add the gateway to the DNS list....

Reply

Answer 12

Sep 10, 2015 8:25 AM in response to Linc Davis

I don't think changing routers is an option -- I think I have to use the one o2 provided.

Is there *any* way that it can be explained why, on my home network, the router gateway must be present in the DNS list for Safari to load any page, either by name or IP?

What is the difference between Chrome and Safari in this regard? If Chrome has no problems, why does Safari?

When I don't have 192.168.1.1 in the DNS list, what precisely is failing, and how? Surely someone at Apple can answer this, yes?

Reply

Answer 13

Linc Davis

Level 10

209,739 points

Sep 8, 2015 9:53 AM in response to CuriousInBerlin

Is it OpenDNS, and/or have you installed any special software to use the service?

Reply

Answer 14

Linc Davis

Level 10

209,739 points

Sep 8, 2015 7:23 PM in response to CuriousInBerlin

It's repeatedly trying and failing to use your primary DNS server. If I were in your place, I'd be looking for another Wi-Fi access point.

Reply

Answer 15

Sep 9, 2015 12:29 AM in response to Linc Davis

Well...this is my home network, so that's not really an option. Perhaps there is some setting on the router I can change....difficult as the interface is all in German...

Reply