DNS

Internal names do not resolve on a VPN

macOS can send queries for one domain to one DNS server and other queries to another. VPNs use this split DNS for internal names.

Applies to: All current macOS versions.Checked: 29 October 2026

Symptoms

  • Internal names such as intranet.corp.example fail, but public sites work.
  • An internal IP address works, but its name does not.
  • dig or nslookup fail, but the browser works, or the opposite.

Likely causes

  • The VPN does not add a resolver for the domain. The VPN must tell macOS which domains go to its DNS servers.
  • A test tool that skips the macOS rules. dig uses the servers in /etc/resolv.conf, not the per-domain resolvers that apps use.
  • Manual DNS servers. DNS servers set by hand on Wi-Fi do not know internal names.
  • A short name without a search domain. A short name such as intranet needs a search domain to become a full name.

How to check

  1. Connect the VPN. Show all resolvers. Look for a resolver with a domain line for your company domain.

    scutil --dns

  2. Look up the name through the macOS resolver, not through dig.

    dscacheutil -q host -a name intranet.corp.example

  3. Show the search domains of the service.

    networksetup -getsearchdomains Wi-Fi

How to fix it

  1. Ask your administrator which domain and DNS server the VPN should use.

  2. Make the folder for per-domain resolvers, if it does not exist.

    sudo mkdir -p /etc/resolver

    Needs an administrator password.

  3. Make a file named after the domain. Put one nameserver line in it for each server.

    sudo nano /etc/resolver/corp.example

    Needs an administrator password.

  4. Type the address of the internal DNS server on one line.

    nameserver 10.0.0.53

  5. Save the file. Run scutil --dns and look for the new domain.

  6. Use full names, or add the search domain in System Settings > Network > the service > Details > DNS.

  7. Remove the file when you no longer need it.

    sudo rm /etc/resolver/corp.example

    Needs an administrator password.

With Kilobat

  1. For a private name, why says which VPN resolver it went to and if that resolver answers.

    kilobat why intranet.corp.example

Questions

Why does dig fail when the browser works?

dig asks the servers in /etc/resolv.conf. The browser uses the macOS resolver, which also uses the per-domain resolvers.

Can I edit /etc/resolv.conf?

No. The resolver man page says that macOS maintains this file automatically. Use Network settings or /etc/resolver.

Sources

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.