---
title: "Mac VPN split DNS: internal names not resolving · Kilobat Guides"
url: "https://kilobat.app/guides/vpn-split-dns-internal-names"
description: "Company hosts such as intranet.corp.example fail on a Mac with the VPN on. Check the per-domain resolvers and add one with /etc/resolver."
---

DNS

# Internal names do not resolve on a VPN

macOS can send queries for one domain to one DNS server and other queries to another. VPNs use this split DNS for internal names.

Applies to: All current macOS versions. · Checked: 29 October 2026

## Symptoms

- Internal names such as `intranet.corp.example` fail, but public sites work.
- An internal IP address works, but its name does not.
- `dig` or `nslookup` fail, but the browser works, or the opposite.

## Likely causes

- **The VPN does not add a resolver for the domain.** The VPN must tell macOS which domains go to its DNS servers.
- **A test tool that skips the macOS rules.** `dig` uses the servers in `/etc/resolv.conf`, not the per-domain resolvers that apps use.
- **Manual DNS servers.** DNS servers set by hand on Wi-Fi do not know internal names.
- **A short name without a search domain.** A short name such as `intranet` needs a search domain to become a full name.

## How to check

1. Connect the VPN. Show all resolvers. Look for a resolver with a `domain` line for your company domain.

   ```
   scutil --dns
   ```
2. Look up the name through the macOS resolver, not through `dig`.

   ```
   dscacheutil -q host -a name intranet.corp.example
   ```
3. Show the search domains of the service.

   ```
   networksetup -getsearchdomains Wi-Fi
   ```

## How to fix it

1. Ask your administrator which domain and DNS server the VPN should use.
2. Make the folder for per-domain resolvers, if it does not exist.

   ```
   sudo mkdir -p /etc/resolver
   ```

   Needs an administrator password.
3. Make a file named after the domain. Put one `nameserver` line in it for each server.

   ```
   sudo nano /etc/resolver/corp.example
   ```

   Needs an administrator password.
4. Type the address of the internal DNS server on one line.

   ```
   nameserver 10.0.0.53
   ```
5. Save the file. Run `scutil --dns` and look for the new domain.
6. Use full names, or add the search domain in System Settings > Network > the service > Details > DNS.
7. Remove the file when you no longer need it.

   ```
   sudo rm /etc/resolver/corp.example
   ```

   Needs an administrator password.

## With Kilobat

1. For a private name, `why` says which VPN resolver it went to and if that resolver answers.

   ```
   kilobat why intranet.corp.example
   ```

## Questions

**Why does dig fail when the browser works?**

`dig` asks the servers in `/etc/resolv.conf`. The browser uses the macOS resolver, which also uses the per-domain resolvers.

**Can I edit /etc/resolv.conf?**

No. The resolver man page says that macOS maintains this file automatically. Use Network settings or `/etc/resolver`.

## Sources

- resolver(5), man page installed with macOS 27.2
- scutil(8), man page installed with macOS 27.2
- dig(1), man page installed with macOS 27.2
- [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

## Related guides

- [DNS queries go outside the VPN on a Mac](https://kilobat.app/guides/vpn-dns-leak-mac): With a VPN on, you usually want DNS queries to go to the VPN's servers.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet): A VPN sends traffic through a tunnel.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect): When the internet works but one address fails, Kilobat checks each layer in turn.