• Mac OS X v10.6: DNS search order behavior
• is dynamic
• In Mac OS X v10.6 and later, the search order
• servers that don't

  respond are moved to the end
• Additional Information
• In Mac OS X v10.6, the default DNS server searching behavior
• when a server does not return a result or when it returns SERV_FAIL
• the server is temporarily disabled

6 more annotations...

• the way the DNS Super client routes queries
• Funny enough, since moving to our new apartment my wife has always been complaining that our internet connection seemed slow (using Leopard).
• a problem on the other end
• shrugged it off
• get around dns based block lists
• an example. There is a single server on the LAN, which provides DNS services
• say it's a Windows Domain Controller (DC)
• DC provides DNS resolution for a Windows Active Directory domain, so clients on the LAN can resolve local services and hosts
• DNS zone for the LAN AD might be ad.internal
• also set up to forward queries to an ISP's DNS server
• DC then caches this reply
• provide the ISP's DNS server as a second DNS server
• set the DHCP service
• This type of setup is common
• Snow Leopard fails to correctly use the LAN DNS server
• local, LAN- based (*ad.internal*) hosts and services are not resolved
• a bug in Snow Leopard
• this type of configuration
• many networks and has historically worked fine
• internal workings of name resolution on Snow Leopard are different
• scutil to determine current DNS service order and then using dig against the first server is therefore flawed
• workaround, until Apple fix or explain this behaviour
• only specify the internal DNS server(s)
• never try a DNS server that can't resolve internal
• super DNS search client
• The bit of name resolution that differs from most other systems is
• DNS Super client

  • http://www.diigo.com/074lv
  Add Sticky Note
• system uses directory services for name resolution

  • Snoop Dogg suggests otherwise.
  Add Sticky Note
• dig or nslookup will properly return the IP of a local hostname, but dscacheutil doesn't
• empty result from dscacheutil
• system no longer uses Directory Services for DNS caching
• now uses mDNSResponder
• dscacheutil commands aren't going to work
• to look at mDNSResponder's record cache
• sudo killall -INFO mDNSResponder
   
   Then look in system.log. 
  
• internal resolver
• dscacheutil command is still the only way to show
• Snoop Dogg; nice pointer
• bug with Apple, RADAR #7204499
• Good work William - thanks
• intermittent - the order of the nameservers seems to change
• wondering if it's Apple's attempt to do some load balancing
• the same functionality is available in BIND >= 8.2
• there is a precedent
• modify the internal DNS
• rotating DNS server use instead of cascading
• internal application servers intermittently become unreachable
• flushing the local DNS cache dscacheutil -flushcache

  • Does this happen when, say, a user switches from one network location to another?
  Add Sticky Note
• more to it than multiple DNS servers

47 more annotations...

• 11-Sep-2009 15:23
• the same functionality is available in BIND >= 8.2
• a precedent
• rotate

  • http://docstore.mik.ua/orelly/networking_2ndEd/dns/appe_05.htm
    
    http://docstore.mik.ua/orelly/networking_2ndEd/dns/ch06_01.htm
    
    http://my.safaribooksonline.com/0596100574?portal=oreilly&cid=orm-cat-readnow-0596100574
  Add Sticky Note
• 11-Sep-2009 15:45
• Apple has not yet confirmed or denied
• a design decision done to perform the equivalent of the BIND "rotate" functionality

5 more annotations...

• 11-Sep-2009 10:52
• mDNSResponder occasionally switches around the order in which it queries DNS servers
• Is the DNS server rotation a bug? A feature?

1 more annotation...

• 09-Nov-2009 19:04
• no reason for BIND or mDNSResponder to query others
• If one returns a legitimate "no such host" response, there is no reason for BIND or mDNSResponder to query others
• a legitimate "no such host" response

2 more annotations...

• 11-Oct-2009 14:42
• The problem with using dig as a test of DNS resolution
• problem with using dig as a test of DNS resolution
• bypasses the mDNSResolver

2 more annotations...

• March 29, 2010

• Request for Comments: 5395
• Best Current Practice
• Domain Name System (DNS) IANA Considerations
• ServFail Server Failure

2 more annotations...

• INTERNET-DRAFT
• 8 March 1998
• Error Record (ERR) for DNS
• SERVFAIL may not be sufficient information

2 more annotations...

• Internet-Draft
• Expires: April 28, 2011
• October 25, 2010
• Improving the caching DNS resolvers on "authority failure"

2 more annotations...

• Troubleshooting DNS
• a table showing the different types of statuses that you could receive
• NOERROR A NOERROR indicates that the domain does exist according to the root name servers and that the authoritative name servers are answering queries correctly for that domain
• SERVFAIL SERVFAIL means that the domain does exist and the root name servers have information on this domain, but that the authoritative name servers are not answering queries for this domain
• NXDOMAIN NXDOMAIN can means that the root name servers are not providing any authoritative name servers for this domain. This can be because the domain does not exist or that the domain is on-hold. Make sure that you use whois when you see an NXDOMAIN

3 more annotations...

• Mac OS X version 10.6
• resolver -- resolver configuration file format
• access to the Internet Domain  Name <!-- a -->System (DNS)
• Mac OS X supports a DNS search strategy that may involve multiple DNS resolver clients
• Each DNS client is configured using the contents of a single configuration file
• "Super" DNS resolver
• search strategy amongst multiple DNS resolver clients
• SEARCH STRATEGY
• Each DNS client  has its own set of nameserver addresses
• multiple DNS client configurations
• Each client has a symbolic name
• "Super"  DNS client
• special meta-client
• Super client chooses among all available clients
• a router for DNS queries
• best match between
• the names of all known clients
• the domain name given in a query
• client configuration that best matches the domain name  given in the query
• If multiple clients are available for the same domain name, the clients ordered according to a  search_order

18 more annotations...

• Referred from http://discussions.apple.com/thread.jspa?threadID=2140119&start=50&tstart=0 (page two of a long discussion re: DNS in Mac OS X 10.6, Snow Leopard). - Graham Perrin on 2009-09-16

• resolver(5) Mac OS X Manual Page

• Last Review: May 13, 2010
• Revision: 3.0
• A new feature is available that enables Outlook 2007 to use DNS Service Location (SRV) records to locate the Exchange Autodiscover service
• enables Outlook 2007 to use DNS Service Location (SRV) records to locate the Exchange Autodiscover service
• also available in Outlook 2010
• When Outlook 2007 is not domain-joined, you have to use a predefined URL method or an HTTP redirect method in order to locate the Autodiscover service

4 more annotations...