First, pardon my ignorance, as I'm still getting acclimated to working with DNS. I'm a networking newbie.

The basic question: How do I determine the source of a DNS record? Or, it may be more accurate to ask: how do I determine where on my network a hostname is being translated into an IP?


  • Actiontek MI424WR-GEN3I (provided as part of FiOS service)
  • MacBookPro running OS X Yosemite
  • VMWare Fusion
  • Ubuntu 14 Server running on VMWare virtual machine

Scenario: I am on a Mac running OS X Yosemite with Ubuntu 14 running in a VMWare virtual machine. I am learning the ropes on setting up a Drupal site (not specifically relevant to the problem), and I've set up virtual hosts on the Ubuntu server. Taking it as a baby-steps process, I first created an entry in my hosts file: cwb1.local

This worked fine, so I got a little more ambitious and removed this hosts file entry and created a DNS entry on my router, pointing the hostname cwb1.local to the IP This seemed to have worked just fine as well. The mystery is that I have since removed this DNS entry and now, as far as I can tell, have no record associating this hostname and IP with each other, yet two strange things happen:

  1. I can ping the hostname and successfully return the IP
  2. I can navigate to http://cwb1.local in my browser and access my Drupal site.

I've cleared my browser's cache and run dscacheutil -flushcache on my mac, even reset my server, and still I can't determine how/why my mac knows to associate this host name and IP together.

Diagnostics: * note, the VM running this server is listed in my router's DHCP connections as 'ubuntu'

MAC:~ me$ nslookup
Address:   name = ubuntu.home.

MAC:~ me$ nslookup cwb1.local

** server can't find cwb1.local: NXDOMAIN

MAC:~ me$ dig cwb1.local

; <<>> DiG 9.8.3-P1 <<>> cwb1.local
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 53342
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;cwb1.local.            IN  A

;; Query time: 49 msec
;; WHEN: Sat Jan 17 20:53:36 2015
;; MSG SIZE  rcvd: 28

MAC:~ me$ dig

; <<>> DiG 9.8.3-P1 <<>>
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 60811
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;          IN  A

.           10800   IN  SOA a.root-servers.net. nstld.verisign-grs.com. 2015011701 1800 900 604800 86400

;; Query time: 50 msec
;; WHEN: Sat Jan 17 21:01:59 2015
;; MSG SIZE  rcvd: 105

Contents of /etc/apache2/sites-available/html.conf

<VirtualHost *:80>
        DocumentRoot /var/www/html
        ServerName drupal7
<VirtualHost *:80>
        DocumentRoot /var/www/html
        ServerName cwb1.local
        ServerAlias cwb1.local *.cwb1.local

Can anyone lend me some guidance here?

Edit After Romeo's comment, I revisited my /etc/hosts file and tried something out: I added a new entry for cwb1.local to an IP that is not present on my network ( Upon pinging cwb1.local, it resolves to (as expected), and each req times out (also as expected). The interesting part is that I removed this entry from my /etc/hosts file, then ran:

  • dscacheutil -flushcache
  • sudo discoveryutil mdnsflushcache
  • sudo discoveryutil udnsflushcaches

and still get the same results: the host name resolves, but packets time out.

So, is my Mac propagating/mirroring this information elsewhere as well? Or is there some sort of buffer that isn't purged with the cache clearing commands above?

Edit 2 So, upon reboot, the host name record seems to have finally disappeared. This indicates pretty strongly that the phantom record is being stored on my Mac. But where/how does this phantom DNS record get stored prior to reboot? How can I ensure in the future that I'm getting accurate DNS information without requiring a reboot?

Again, my thanks to all who can lend some insight!

  • Also, if this is normal/expected behavior, can anyone explain it to me? – Beau Jan 18 '15 at 2:42
  • Beau, check your /etc/hosts file for record for cwb1.local – Romeo Ninov Jan 18 '15 at 4:44
  • Romeo, thanks for the suggestion. I double-checked my /etc/hosts file and there is no cwb1.local entry. I should have been more clear in my original post - I originally had an entry in my /etc/hosts file, but then removed it because I had created a DNS entry on my router. – Beau Jan 19 '15 at 0:04
  • However, this comment did give me the idea to experiment with my hosts file - please see amended question for details. – Beau Jan 19 '15 at 0:17
  • Beau, on UNIX/Linux (not sure about MacOS) there is one name service cache daemon which cache the name resolving requests. Which can be the reason for this behavior. BTW check with this command: dscacheutil -flushcache – Romeo Ninov Jan 19 '15 at 4:40

Yosemite changed the commands to flush DNS:

sudo discoveryutil mdnsflushcache
sudo discoveryutil udnsflushcaches

According to https://discussions.apple.com/message/27173761?ac_cid=op123456#27173761, all .local domains are now resolved exclusively through mdns/Bonjour. Since Ubuntu enables mdns/avahi-daemon by default, you're likely not hitting the DNS server at all.

You can disable this temporarily with service avahi-daemon stop to see if that resolves the issue. See https://askubuntu.com/questions/205937/how-can-i-disable-avahi-daemon

  • Jeremiah, I appreciate the updated info, but these commands didn't change any of the weird behavior. – Beau Jan 18 '15 at 2:42
  • I don't appear to have avahi-daemon installed on either my mac or Ubuntu. Looks like an interesting utility, though! – Beau Jan 18 '15 at 4:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.