Why don't Firefox and Chrome respect my local DNS resolver?

Question

I have a local DNS set up in OSX (192.168.1.100) which is configured to return the IP address of servers on my local network for specific domain names (they're all hosted on a NAS, which also hosts the DNS server.)

These are valid TLDs that I own (.net root) with no DNS records on the public Internet. I.E. I own my-local-domain.net registered with a public registrar and it has no records on any DNS servers outside my local network.

I have verified the local DNS server is responding with dig through terminal:

My-MacBook-Pro:~ me$ dig my-local-domain.net @192.168.1.100

; <<>> DiG 9.10.6 <<>> my-local-domain.net @192.168.1.100
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13199
;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;my-local-domain.net.       IN  A

;; ANSWER SECTION:
my-local-domain.net.    0   IN  A   192.168.1.100

;; Query time: 3 msec
;; SERVER: 192.168.1.100#53(192.168.1.100)
;; WHEN: Wed Sep 11 20:18:36 +07 2019
;; MSG SIZE  rcvd: 53

Chrome and Firefox both show "IP address cannot be found" error messages (ERR_NAME_NOT_RESOLVED in Chrome.)

Meanwhile, Safari resolves the correct local IP address and displays the expected content, however one of the services I'm running does not support it - therefore this is not a valid workaround.

My system DNS settings set the local server as the primary resolver, with Cloudflare's 1.1.1.1 and Google's 8.8.8.8 as secondary and tertiary respectively.

I have tried flushing my local DNS cache several times through the terminal.

Why don't Firefox and Chrome respect my local resolver, while Safari does?

I installed Firefox after setting up the local DNS resolver, if it makes any difference.

The anonymised terminal output above accurately reflects both input and output from the dig command.

Dans-MacBook-Pro:~ dancowell$ scutil --dns
DNS configuration

resolver #1
  search domain[0] : localdomain
  nameserver[0] : 192.168.1.100
  nameserver[1] : 1.1.1.1
  nameserver[2] : 8.8.8.8
  flags    : Request A records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

resolver #2
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300000

resolver #3
  domain   : 254.169.in-addr.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300200

resolver #4
  domain   : 8.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300400

resolver #5
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300600

resolver #6
  domain   : a.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 300800

resolver #7
  domain   : b.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  reach    : 0x00000000 (Not Reachable)
  order    : 301000

DNS configuration (for scoped queries)

resolver #1
  search domain[0] : localdomain
  nameserver[0] : 192.168.1.100
  nameserver[1] : 1.1.1.1
  nameserver[2] : 8.8.8.8
  if_index : 5 (en0)
  flags    : Scoped, Request A records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

Answer 1

This might be related to DNS-over-HTTPS (DoH).

Chrome and Firefox are now pushing DNS-over-HTTPS (DoH). Never heard of it? Well, Wikipedia describes DNS-over-HTTPS (DoH):

DNS over HTTPS (DoH) is a protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. A goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks. As of March 2018, Google and the Mozilla Foundation are testing versions of DNS over HTTPS.

---

Chrome and DNS over HTTPS (DoH)

Here is info on Chrome’s use of it:

Google has announced that they would soon be performing a trial of utilizing DNS-over-HTTPS (DoH) in the Google Chrome browser. This experiment will be conducted in Chrome 78 and will attempt to upgrade a user's DNS server to a corresponding DoH server, and if available, use that for DNS resolution.

And here is how to disable it in Chrome:

If users don't want to be included in the Chrome DoH experiment, they can use a DNS provider that's not on Google's list (which most of the Chrome userbase already does), or they can disable DoH support by modifying the chrome://flags/#dns-over-https flag.

---

Firefox and DNS over HTTPS (DoH)

And here is info on how Mozilla is implementing it in Firefox:

Starting the week of April 1, a small portion of our United States-based users in the Release channel will receive the DoH treatment. As before, this study will use Cloudflare’s DNS-over-HTTPS service and will continue to provide in-browser notifications about the experiment so that participants are fully informed and has the opportunity to decline.

We are working to build a larger ecosystem of trusted DoH providers, and we hope to be able to experiment with other providers soon. As before, we will continue to share the results of the DoH tests and provide updates once future plans solidify.

And here is info on how to disable it in Firefox:

To turn DoH off in your Firefox, go to Settings -> Network Settings and untick the Enable DNS over HTTPs checkbox.

Alternatively, go to about:config in the address bar, search for network.trr.mode and set it to 5.

Answer 2

In my case it was nsswitch.conf in my desktop computer. I configured in bind something.local and it didn't work for browsers, however bind was resolving correctly the .local zone using dig. This was my nsswitch.conf:

hosts:      files myhostname mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns

The mdns4_minimal module searches the local LAN subnet using Multicast DNS (mDNS), then returns "not found" then [NOTFOUND=return] applies and exits. Therefore dns is not going to be reached.

This is a possible workaround (It worked for me in my use case):

hosts:      files dns

Answer 3

Just now, I've resolved this somewhat similar situation for my setup. I set a static DNS entry for a subdomain on my router but Chrome always says ERR_NAME_NOT_RESOLVED. IE and Firefox opens the subdomain properly.

It was, in fact, DoH. I disabled it and Chrome opened my local server without a hitch.

To disable it, I went to Chrome's settings, searched "dns", and under Security I disabled secure DNS.