DNS, or the Domain Name System, translates website names such as 4macos.com into IP addresses that computers use to connect. When browsing is slow or a website will not open, checking DNS settings and testing DNS resolution in Terminal can help determine whether the problem is with your Mac, your network, or the DNS service itself.
This guide shows how to inspect the DNS servers configured on your Mac, test individual lookups, compare DNS servers, and clear cached DNS information when appropriate.
Quick Answer
Open Terminal from Applications > Utilities, then run:
scutil --dns
This displays the DNS configuration currently used by macOS.
To test whether a domain resolves to an IP address, run:
dig example.com
Look for an ANSWER SECTION in the output. You can also run a shorter test:
dig +short example.com
If the lookup fails, compare results with a specific DNS server:
dig @1.1.1.1 example.com
Replace example.com with the domain you want to check.
What DNS Settings and DNS Resolution Mean
Your Mac may receive DNS server addresses automatically from your Wi-Fi router, Ethernet network, VPN, or another network service. You can also configure DNS servers manually in System Settings.
DNS resolution is the process of converting a domain name into an IP address. For example, a successful lookup may return one or more IPv4 addresses, IPv6 addresses, or other records. A failed lookup does not necessarily mean that your internet connection is completely down. It may indicate a DNS server problem, a domain-specific problem, a VPN configuration issue, or a local cache issue.
Terminal is useful because it lets you examine the resolver configuration and test a domain without relying on a web browser.
Open Terminal
- Open Finder.
- Select Applications in the sidebar.
- Open the Utilities folder.
- Double-click Terminal.
You can also press Command-Space, type Terminal, and press Return.
The commands in this guide inspect network information or perform DNS queries. They do not change your DNS settings unless specifically noted.
Check the DNS Servers macOS Is Using
Before running a lookup, inspect the DNS configuration supplied to macOS.
scutil --dns
The scutil --dns command displays the system’s resolver configuration. Depending on your network, the output can include:
- DNS server addresses
- Search domains
- Resolver order
- Interface-specific resolver information
- Supplemental resolvers used by VPNs or other services
Look for lines containing nameserver, followed by an IP address. Those are DNS servers that macOS may use for resolution.
The output can be lengthy. To display only lines that contain nameserver information, use:
scutil --dns | grep nameserver
This filters the command’s output but does not alter your configuration.
A Mac can have more than one resolver configuration at the same time. For example, a VPN may add its own DNS resolver, while Wi-Fi provides another. The resolver that answers a particular query depends on the active network service and macOS’s resolver rules.
Check DNS Settings for a Specific Network Service
The networksetup command can show DNS servers assigned to a particular network service. First, list the available service names:
networksetup -listallnetworkservices
The result commonly includes services such as Wi-Fi and Ethernet, although the names depend on your Mac and network setup.
To display DNS servers assigned to Wi-Fi, run:
networksetup -getdnsservers Wi-Fi
If your service has a different name, replace Wi-Fi with that exact name. For example:
networksetup -getdnsservers Ethernet
If the output says that DNS servers are provided automatically, the service is likely receiving them from the network rather than using manually entered addresses.
Check DNS Settings in System Settings
Terminal shows the configuration in a compact, technical form. For a visual view:
- Open the Apple menu and choose System Settings.
- Select Network.
- Select the active connection, such as Wi-Fi.
- Click Details.
- Select DNS.
The DNS section shows configured DNS servers and search domains for that network service. Do not change values unless you know which DNS servers you intend to use.
Test DNS Resolution with dig
The dig command performs a DNS query and displays the response in detail. To test a domain, run:
dig example.com
Replace example.com with the domain you want to test.
Important parts of the output include:
SERVER: the DNS server that respondedQUESTION SECTION: the domain and record type requestedANSWER SECTION: the answer returned by the DNS serverQuery time: how long the query tookstatus: whether the query succeeded
For a standard domain lookup, dig requests an A record, which contains IPv4 addresses. A successful response generally includes an ANSWER SECTION, although the section may be empty when a domain has no record of the requested type.
To request IPv6 addresses, use an AAAA query:
dig AAAA example.com
To request mail-server records, use:
dig MX example.com
These queries do not change DNS settings or contact the website itself. They ask a DNS server for a particular type of record.
Display Only the Returned IP Addresses
Full dig output is useful for diagnosis, but +short produces a compact result:
dig +short example.com
For an IPv6 lookup:
dig +short AAAA example.com
This is convenient when you only need to know whether the domain returns an address. A blank result means that the query did not return an address of that record type. It does not, by itself, identify the cause.
Test a Specific DNS Server
To determine whether the issue is related to the DNS server currently selected by your Mac, query another DNS server directly:
dig @1.1.1.1 example.com
Here, @1.1.1.1 tells dig which DNS server to use for this query. It does not permanently change your Mac’s DNS configuration.
You can compare the result with another public DNS server:
dig @8.8.8.8 example.com
You may also query one of the DNS server addresses shown by scutil --dns.
When comparing results, check:
- Whether each server returns an answer
- The returned addresses
- The
Query time - The
SERVERline - Any error shown in the
statusfield
Different DNS servers can return different answers because of caching, geographic routing, filtering, or DNS configuration. A difference is not automatically evidence that one server is broken.
Check Whether a Domain Is Delegated Correctly
The +trace option follows the DNS lookup path from the root DNS servers toward the domain’s authoritative servers:
dig +trace example.com
This can help identify where a lookup stops. For example, it may reveal a problem involving the domain’s delegation or authoritative DNS servers rather than your Mac’s local configuration.
A trace can produce a large amount of output and may take longer than a normal lookup. It also depends on your network being able to reach DNS servers.
Use nslookup for a Simpler Interactive Test
macOS also includes nslookup, which provides another way to query DNS:
nslookup example.com
The output usually identifies the DNS server used and displays the address returned for the domain.
To query a particular DNS server:
nslookup example.com 1.1.1.1
The first argument is the domain, and the second is the DNS server to query. Like dig @server, this performs a one-time test and does not change your network settings.
dig is generally more detailed and easier to use for examining record types, while nslookup can be convenient for a quick confirmation.
Clear the DNS Cache
macOS maintains DNS-related cached information so repeated lookups can be faster. If a domain recently changed DNS records, or if your Mac appears to be using outdated information, restarting the DNS responder may help.
The command is:
sudo killall -HUP mDNSResponder
This asks the DNS responder process to reload. You will be prompted for your administrator password. Terminal does not display characters while you type the password; press Return when finished.
This command does not permanently change your DNS servers. It may temporarily interrupt DNS lookups while the process reloads, but macOS manages the service automatically. No reversal command is normally required. If connectivity does not return, wait briefly, disconnect and reconnect to the network, or restart the Mac.
Do not use cache clearing as a first step for every DNS problem. First inspect the configuration and test resolution, because those results provide more useful diagnostic information.
Change DNS Servers Temporarily or Permanently
You can change DNS servers in System Settings, but this changes network behavior and may affect browsing, filtering, parental controls, VPN use, or access to internal company resources.
Before changing anything, record the existing DNS values from:
networksetup -getdnsservers Wi-Fi
To set specific DNS servers for Wi-Fi, use:
sudo networksetup -setdnsservers Wi-Fi 1.1.1.1 8.8.8.8
Replace Wi-Fi with the correct service name and replace the addresses with the DNS servers you intend to use.
To return Wi-Fi to automatic DNS assignment, use:
sudo networksetup -setdnsservers Wi-Fi empty
This removes manually assigned DNS servers for that service and allows the network to provide DNS settings again. If you changed Ethernet or another service, replace Wi-Fi with that service name.
After making a change, verify it:
networksetup -getdnsservers Wi-Fi
Then test resolution:
dig +short example.com
If the change causes problems, use the empty command above to restore automatic DNS, or re-enter the original DNS addresses you recorded. Be careful when changing DNS on a work, school, or managed Mac; local network services may depend on specific resolvers.
Troubleshooting DNS Problems
dig returns connection timed out
A timeout can mean that the selected DNS server is unreachable, blocked, or temporarily unavailable. Test another server:
dig @1.1.1.1 example.com
If every server times out, check whether your Mac is connected to Wi-Fi or Ethernet and whether other internet services work.
dig returns SERVFAIL
SERVFAIL means the DNS server could not provide a valid answer. Try the same query against another resolver:
dig @8.8.8.8 example.com
If only one server returns SERVFAIL, the problem may be specific to that resolver. If several servers return the same result, the domain’s DNS configuration may need attention.
dig returns NXDOMAIN
NXDOMAIN means the DNS server reports that the requested domain name does not exist. Check the spelling carefully. If the domain should exist, compare results with another DNS server and check whether the domain recently changed.
The DNS server looks unexpected
Run:
scutil --dns
Check for resolver entries associated with a VPN, security product, configuration profile, or other network service. Temporarily disconnecting a VPN can help isolate the cause, but do not disconnect from a work or school VPN if doing so could interrupt required access or unsaved work.
DNS works, but websites still do not open
A successful DNS response only confirms that a name was resolved. It does not prove that the website is reachable or that the web server is working. The problem may involve routing, a firewall, a proxy, TLS, the browser, or the website itself.
Only one app has a problem
If Terminal resolves the domain but one app does not, quit and reopen that app. Check its proxy, VPN, or network settings. Avoid closing apps that contain unsaved work.
Frequently Asked Questions
How do I see the DNS server currently used by my Mac?
Run:
scutil --dns
Then look for nameserver entries. Because macOS can maintain multiple resolver configurations, the displayed list may include more than one DNS server.
Does dig change my DNS settings?
No. Commands such as dig, dig @server, nslookup, and scutil --dns inspect or query DNS. They do not permanently change network settings.
What is the difference between dig and nslookup?
Both can query DNS. dig provides more detailed output and supports options such as +short, record types, and +trace. nslookup is useful for a quick lookup or a simple server comparison.
Should I always use a public DNS server?
Not necessarily. A router, workplace, school, VPN, or private network may require its own DNS server. Test before changing settings, and restore automatic DNS if a manual configuration prevents access to local resources.
How can I check whether DNS is the cause of a slow connection?
Compare a normal lookup with a direct query to another DNS server:
dig example.com
dig @1.1.1.1 example.com
Compare the response status and query times, but remember that DNS is only one part of a network connection.
Final Thoughts
Use scutil --dns to inspect the DNS configuration macOS sees, networksetup to check a specific network service, and dig or nslookup to test resolution. Querying another DNS server can help separate a local resolver problem from a domain or network problem. Change DNS settings only after recording the original values, and restore automatic DNS when a manual configuration is no longer needed.