DNS

DNS queries go outside the VPN on a Mac

Q: Why do I see more than one resolver?

macOS can use many resolvers. Resolvers with a domain line answer only for that domain. The scutil man page explains this.

With a VPN on, you usually want DNS queries to go to the VPN's servers. Some settings send them to the local network's servers instead.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current macOS versions.Checked: 29 October 2026

Symptoms

The VPN is connected, but a DNS test shows the local provider's servers.
Sites see your local network's DNS server while the VPN is on.
Internal names work, but other names use the local network's DNS.

Likely causes

Manual DNS servers on Wi-Fi or Ethernet. Servers that you typed in for a network service can stay in use beside the VPN's servers.
A split-tunnel VPN. Some VPNs send only some domains or networks through the tunnel. Other queries use the local servers.
An encrypted DNS profile or a DNS app. A DNS Settings profile or another DNS app can send queries to its own server.
The VPN app's settings. Many VPN apps have their own DNS options. These options decide which servers macOS gets.

How to check

Connect the VPN. Show the DNS configuration. Resolver #1 is the default for most names.
```
scutil --dns
```
Output Each resolver with its nameserver addresses, its if_index interface and, for some, a domain.
Find the interface of resolver #1. A VPN interface often has a name such as utun.
```
ifconfig -l
```
Look for DNS servers that you set by hand on the physical service.
```
networksetup -getdnsservers Wi-Fi
```
Look for profiles. On macOS 15 and later, choose Apple menu > System Settings > General > Device Management.
On macOS 13 and 14, choose Apple menu > System Settings > Privacy & Security > Profiles.

How to fix it

Remove DNS servers that you set by hand on Wi-Fi or Ethernet, if you do not need them.
```
networksetup -setdnsservers Wi-Fi empty
```
Needs an administrator password.
Open the VPN app's settings. Turn on its option to use the VPN's DNS, if it has one.
Remove a DNS profile that you do not need. Select it in Device Management or Profiles, then click the Remove button.
Disconnect and connect the VPN again. Run scutil --dns again and compare.
Ask the VPN provider or your administrator which DNS servers the tunnel should use.

With Kilobat

Kilobat lists the VPN interfaces beside the physical ones.
```
kilobat interfaces --json
```
For a private name, why says which VPN resolver it went to and if it answers. It also compares the direct path with the tunnel.
```
kilobat why intranet.corp.example
```

Questions

Does a VPN always handle all DNS?

No. The VPN decides. A split-tunnel VPN can send only some domains to its DNS servers.

Why do I see more than one resolver?

macOS can use many resolvers. Resolvers with a domain line answer only for that domain. The scutil man page explains this.

Sources

scutil(8), man page installed with macOS 27.2
resolver(5), man page installed with macOS 27.2
Apple Support: Change DNS settings on Mac
Apple Support: Change the order of the network services your Mac uses
Apple Support: Use configuration profiles to standardize settings on Mac computers

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.