/etc/resolver and adding text files that match your domain names. This method allows specific domains to resolve through different servers without altering global network settings, improving performance or bypassing restrictions for targeted traffic while keeping the rest of your system intact.
Understanding the /etc/resolver Directory
The /etc/resolver directory is a powerful feature in macOS that enables per-domain DNS configuration. Unlike changing the DNS settings in System Preferences, which affects all network interfaces and domains globally, this approach provides granular control. When you place a file inside this directory with the same name as a domain (for example, example.com), macOS will use the DNS servers listed in that file specifically for queries related to that domain.
This mechanism is handled by the mDNSResponder service, which manages name resolution on macOS. By leveraging this system-level feature, you can route internal corporate domains to private DNS servers while sending public web traffic to public resolvers like Google or Cloudflare. It eliminates the need for complex routing rules or proxy configurations for simple DNS redirection tasks.
Prerequisites and Permissions
Before creating any configuration files, you must ensure you have administrative privileges on your Mac. The /etc directory is protected by macOS security protocols, meaning standard user accounts cannot write to it directly. You will need to use the Terminal application to execute commands with elevated permissions.
Additionally, verify that your current network connection is stable. While configuring DNS does not require an active internet connection for the setup itself, having connectivity helps you verify the changes immediately after applying them. If you are working on a remote server via SSH, ensure you have sudo access configured correctly.
Step-by-Step Configuration Guide
To set up a custom DNS resolver, follow these precise steps using the Terminal app:
- Create the Resolver Directory: First, check if the directory exists. If it does not, create it using the following command. You may be prompted for your administrator password.
sudo mkdir -p /etc/resolver- Create the Domain File: Create a new file named exactly after the domain you wish to redirect. For example, to configure DNS for
internal.company.com, create a file namedinternal.company.com. Use a text editor likenanoorvim.
sudo nano /etc/resolver/internal.company.com- Add DNS Servers: Inside the file, add one or more lines starting with
nameserver, followed by the IP address of your desired DNS resolver. You can specify multiple servers for redundancy.
nameserver 8.8.8.8
nameserver 8.8.4.4- Save and Exit: If using
nano, pressCtrl+Oto save, thenCtrl+Xto exit. Ensure there are no trailing spaces or syntax errors in the file.
Repeat this process for each domain you need to route differently. Each file should correspond to a unique domain suffix.
Applying and Verifying Changes
macOS typically picks up changes to /etc/resolver automatically within a few seconds. However, to ensure immediate effect, you may need to flush the DNS cache. On modern versions of macOS, including Monterey and later, clearing the cache has become more restricted due to security enhancements. If you encounter issues where changes do not take effect, refer to our guide on Cannot clear DNS cache on MacOS Monterey for troubleshooting specific cache invalidation methods.
To verify that your configuration is working, use the dig or nslookup commands from the terminal. Query a host within the configured domain and observe which server responds. For example:
dig @8.8.8.8 host.internal.company.comIf the response comes from the specified IP, your configuration is active. You can also check system logs for any resolver-related errors if connectivity issues arise.
Troubleshooting Common Issues
One common issue is incorrect file permissions. The files in /etc/resolver should generally be readable by all users but writable only by root. Incorrect permissions can cause the resolver to fail silently. Ensure files are owned by root:wheel using sudo chown root:wheel /etc/resolver/domain.
Another potential problem arises when conflicting network configurations exist. If you have static DNS settings assigned via DHCP or manual interface settings, they might override local resolver rules depending on the search path priority. For broader network interface DNS issues, especially on WiFi, consult Configuring DNS Server Network Interfaces for WiFi Networks on MacOS to understand how interface-level settings interact with system-wide resolvers.
Firewall software or antivirus programs may also block DNS queries to non-standard ports or IPs. Ensure your security suite allows outbound UDP/TCP traffic on port 53 for the configured resolvers.
Frequently Asked Questions
Can I use IPv6 addresses in /etc/resolver?
Yes, you can specify IPv6 nameservers just as easily as IPv4 addresses. Simply enter the full IPv6 address after the nameserver keyword in the configuration file. This is useful for networks that rely heavily on IPv6 infrastructure.
What happens if the custom DNS server is unreachable?
If the primary nameserver is unreachable, macOS will typically fall back to the secondary nameserver listed in the file. If all listed servers are unreachable, the system may revert to the default DNS settings configured in System Preferences, depending on the timeout settings.
Does this affect HTTPS certificate validation?
No, changing DNS resolvers does not impact SSL/TLS certificate validation. Certificates are validated against the public key infrastructure and the domain name in the URL, not the DNS server used to resolve the IP address. Your secure connections remain encrypted and verified normally.
How do I remove a custom DNS configuration?
To remove a custom DNS rule, simply delete the corresponding file from the /etc/resolver directory using sudo rm /etc/resolver/domain-name. After deletion, the system will stop using the custom resolver for that domain and revert to default resolution methods.
Are there limits to the number of domains I can configure?
There is no strict limit imposed by macOS on the number of files you can create in /etc/resolver. However, extremely large numbers of entries may slightly increase lookup latency. For most home and office use cases, dozens or even hundreds of domain-specific resolvers will perform flawlessly.