20

In Mac OS X (Mavericks) I see multiple resolvers, and I don't understand the difference between scoped and non-scoped DNS query resolvers as displayed below:

$ scutil --dns
DNS configuration

resolver #1
  search domain[1] : test
  nameserver[0] : 172.31.30.10
  flags    : Request A records
  reach    : Reachable

.... <arpa stuff snipped> ...
resolver #6
  domain   : 9.e.f.ip6.arpa
  options  : mdns
  timeout  : 5
  flags    : Request A records
  order    : 300600

DNS configuration (for scoped queries) 

resolver #1
  search domain[0] : test
  nameserver[0] : 172.31.30.10
  if_index : 4 (en0)
  flags    : Scoped, Request A records
  reach    : Reachable
Improve this question

1 Answer 1

Reset to default
19

Briefly speaking, a scoped DNS query can use only specified network interfaces (e.g. Ethernet or WiFi), while non-scoped can use any available interface.

More verbosely, an application that wants to resolve a name, sends a request (either scoped or non-scoped) to a resolver (usually a DNS client application), if the resolver does not have the answer cached, it sends a DNS query to a particular nameserver (and this goes through one interface, so it is always "scoped").

In your example resolver #1 "for scoped queries" can use only en0 interface (Ethernet).

Improve this answer
6
  • So the application decides whether to make the query scoped or nonscoped? What is the default behavior, and/or which would dig or a web browser use?
    – Keith Bennett
    Jan 31, 2018 at 4:16
  • 1
    An application like a web browser most probably queries the meta-resolver, which routes the queries to different resolvers according to rules described in resolver(5) manpage. Applications like dig or host make the queries directly to nameservers, not using the Mac OS X DNS query routing mechanism.
    – mik
    Feb 2, 2018 at 23:42
  • So, in this case both the application and the resolver can be viewed as DNS client applications? In theory, couldn't that nameserver be reached on more than one interface, and thus be non-scoped? - ... if the resolver does not have the answer cached, it sends a DNS query to a particular nameserver (and this goes through one interface, so it is always "scoped").
    – Shuzheng
    Apr 4, 2021 at 10:23
  • @Shuzheng, yes, from the point of view of network both resolvers and applications like dig are DNS clients; a nameserver could be reachable by many interfaces, but I wouldn't call it "non-scoped" because is not its property, but merely a property of resolver and network configuration
    – mik
    Apr 4, 2021 at 12:45
  • @mik - thanks! Also, "an application that wants to resolve a name, sends a request", by request, do you mean a valid DNS query, or some custom platform-specific request? Aren't most DNS nameservers also DNS clients? If they cannot answer the request, they will recursively ask the next nameserver in the chain? What's the difference between a resolver and a DNS nameserver? Is the only difference that a DNS nameserver corresponds to a domain, where as a resolver does not?
    – Shuzheng
    Apr 4, 2021 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .