8

I have a local DNS set up in OSX (192.168.1.100) which is configured to return the IP address of servers on my local network for specific domain names (they're all hosted on a NAS, which also hosts the DNS server.)

These are valid TLDs that I own (.net root) with no DNS records on the public Internet. I.E. I own my-local-domain.net registered with a public registrar and it has no records on any DNS servers outside my local network.

I have verified the local DNS server is responding with dig through terminal:

My-MacBook-Pro:~ me$ dig my-local-domain.net @192.168.1.100

; <<>> DiG 9.10.6 <<>> my-local-domain.net @192.168.1.100
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13199
;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;my-local-domain.net.       IN  A

;; ANSWER SECTION:
my-local-domain.net.    0   IN  A   192.168.1.100

;; Query time: 3 msec
;; SERVER: 192.168.1.100#53(192.168.1.100)
;; WHEN: Wed Sep 11 20:18:36 +07 2019
;; MSG SIZE  rcvd: 53

Chrome and Firefox both show "IP address cannot be found" error messages (ERR_NAME_NOT_RESOLVED in Chrome.)

Meanwhile, Safari resolves the correct local IP address and displays the expected content, however one of the services I'm running does not support it - therefore this is not a valid workaround.

My system DNS settings set the local server as the primary resolver, with Cloudflare's 1.1.1.1 and Google's 8.8.8.8 as secondary and tertiary respectively.

I have tried flushing my local DNS cache several times through the terminal.

Why don't Firefox and Chrome respect my local resolver, while Safari does?

I installed Firefox after setting up the local DNS resolver, if it makes any difference.

The anonymised terminal output above accurately reflects both input and output from the dig command.

Dans-MacBook-Pro:~ dancowell$ scutil --dns
DNS configuration

resolver #1
  search domain[0] : localdomain
  nameserver[0] : 192.168.1.100
  nameserver[1] : 1.1.1.1
  nameserver[2] : 8.8.8.8
  flags    : Request A records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

resolver #2
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #3
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #4
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #5
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #6
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #7
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  search domain[0] : localdomain
  nameserver[0] : 192.168.1.100
  nameserver[1] : 1.1.1.1
  nameserver[2] : 8.8.8.8
  if_index : 5 (en0)
  flags    : Scoped, Request A records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)
7
  • 1
    It would help to see your /etc/resolv.conf as well as the output of scutil --dns
    – Spiff
    Sep 11, 2019 at 14:42
  • 1
    Do you have the local DNS server configured to resolve queries for all other domains (perhaps by forwarding those queries along to a public DNS server)? If not, Firefox and Chrome may have disqualified it because it couldn't resolve, say, the hostname of their respective software update servers where they check for updates on each launch.
    – Spiff
    Sep 11, 2019 at 17:22
  • Yes, the local DNS server is configured to forward all other domain queries to 1.1.1.1 and 8.8.8.8. I have verified that this forwarding works as expected - I can successfully resolve any domain's records via dig
    – Dan Cowell
    Sep 11, 2019 at 22:34
  • Also added the output from scutil --dns above. /etc/resolv.conf has the same nameservers as seen in the output from scutil - I have not edited that file myself, all configuration has been done in the MacOS System Preferences application.
    – Dan Cowell
    Sep 11, 2019 at 22:37
  • 1
    Sorry for the red herring there Spiff - I was messing around with the DNS settings between running scutil and copied the wrong output. I've put everything back to how it was originally and can still reproduce the problem. I've also updated the question with my current scutil output.
    – Dan Cowell
    Sep 12, 2019 at 14:53

3 Answers 3

3

This might be related to DNS-over-HTTPS (DoH).

Chrome and Firefox are now pushing DNS-over-HTTPS (DoH). Never heard of it? Well, Wikipedia describes DNS-over-HTTPS (DoH):

DNS over HTTPS (DoH) is a protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. A goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks. As of March 2018, Google and the Mozilla Foundation are testing versions of DNS over HTTPS.


Chrome and DNS over HTTPS (DoH)

Here is info on Chrome’s use of it:

Google has announced that they would soon be performing a trial of utilizing DNS-over-HTTPS (DoH) in the Google Chrome browser. This experiment will be conducted in Chrome 78 and will attempt to upgrade a user's DNS server to a corresponding DoH server, and if available, use that for DNS resolution.

And here is how to disable it in Chrome:

If users don't want to be included in the Chrome DoH experiment, they can use a DNS provider that's not on Google's list (which most of the Chrome userbase already does), or they can disable DoH support by modifying the chrome://flags/#dns-over-https flag.


Firefox and DNS over HTTPS (DoH)

And here is info on how Mozilla is implementing it in Firefox:

Starting the week of April 1, a small portion of our United States-based users in the Release channel will receive the DoH treatment. As before, this study will use Cloudflare’s DNS-over-HTTPS service and will continue to provide in-browser notifications about the experiment so that participants are fully informed and has the opportunity to decline.

We are working to build a larger ecosystem of trusted DoH providers, and we hope to be able to experiment with other providers soon. As before, we will continue to share the results of the DoH tests and provide updates once future plans solidify.

And here is info on how to disable it in Firefox:

To turn DoH off in your Firefox, go to Settings -> Network Settings and untick the Enable DNS over HTTPs checkbox.

Alternatively, go to about:config in the address bar, search for network.trr.mode and set it to K.

1
  • 5
    I just checked my Firefox settings and DNS over HTTPS was not checked. Wondering if I'm going to have to bust out wireshark or some other network proxy to get to the bottom of this.
    – Dan Cowell
    Sep 12, 2019 at 14:57
2

In my case it was nsswitch.conf in my desktop computer. I configured in bind something.local and it didn't work for browsers, however bind was resolving correctly the .local zone using dig. This was my nsswitch.conf:

hosts:      files myhostname mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns

The mdns4_minimal module searches the local LAN subnet using Multicast DNS (mDNS), then returns "not found" then [NOTFOUND=return] applies and exits. Therefore dns is not going to be reached.

This is a possible workaround (It worked for me in my use case):

hosts:      files dns
1
  • 2
    While I didn't use your solution, your note of it being /etc/nsswitch.conf was correct. For any future people, I moved cut and pasted dns to be the second entry bypassing the other options. It's likely that you can just remove the [NOTFOUND=return] for most use cases.
    – plunker
    Oct 17, 2022 at 22:39
0

Just now, I've resolved this somewhat similar situation for my setup. I set a static DNS entry for a subdomain on my router but Chrome always says ERR_NAME_NOT_RESOLVED. IE and Firefox opens the subdomain properly.

It was, in fact, DoH. I disabled it and Chrome opened my local server without a hitch.

To disable it, I went to Chrome's settings, searched "dns", and under Security I disabled secure DNS.

enter image description here

Switch this off

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .