First, prove it really is DNS
Nearly every wasted hour here comes from skipping this. Reach an address made of numbers, then reach one made of words. A numeric address needs no lookup, so it tests the connection on its own.
% ping -c 3 1.1.1.13 packets transmitted, 3 packets received, 0.0% packet lossReplies mean the connection itself is working. No replies means this is not a DNS problem — the network is down.
% ping -c 3 apple.comping: cannot resolve apple.com: Unknown hostThe number answered and the name did not. That is DNS failing, and the rest of this page applies.
If both fail, stop here — the connection is the problem, not the lookup.
Check which servers your Mac is actually asking
Pages fail everywhere, in every browser, on this Mac only.
Your Mac normally takes its DNS servers from the router. The settings screen shows what you typed; it does not always show what is in effect, because a VPN or network app can override it.
% scutil --dns | head -20resolver #1
nameserver[0] : 192.168.1.1
if_index : 14 (en0)The nameserver lines are the servers being asked right now. An address you do not recognise usually belongs to network software.
Fixif the listed server is the router and nothing else on the network can browse either, the router's own lookup service is the suspect — restart it before changing anything on the Mac.
Clear the saved answers
One site fails while others load, or a site started failing right after it moved or changed host.
Your Mac remembers recent lookups for a while so pages open faster. If an answer was saved while something was broken, or a site has since moved, the saved answer keeps being used.
% sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponderAsks for your password and prints nothing when it works. Silence is success here.
Fixclear the saved answers, then reload the failing page. If it works, a stale answer was the cause and nothing further is needed.
Rule out a VPN or content filter
The failure started after installing a VPN, a security tool, or parental controls — or after one of those was removed.
These work by handling your lookups for you. When they are uninstalled carelessly, or disconnect without cleaning up, the Mac can keep sending lookups to a server that is no longer answering.
This is the case where the settings screen is least trustworthy, which is why the resolver check above matters more than what any preference pane displays.
What Noah can determine on this Mac
NoahNoah can run the numeric-versus-name test for you. It reads the resolvers actually in effect rather than the ones configured, which is how a resolver belonging to network software gives itself away. It then tells you whether the failure is on this Mac or upstream at the router. That split decides whether changing anything here can help.
Noah will not silently repoint your Mac at a different DNS provider. Changing where your lookups go is a real change to how the machine reaches the internet, so it is proposed with the reason and applied only with your approval.
The short version
- A number answers and a name does not: DNS is the problem.
- Neither answers: the connection is the problem, and this page does not apply.
- Read the resolvers in effect, not the ones in the settings screen.
- Clear the saved answers before changing any configuration.
- If every device on the network fails the same way, fix the router, not the Mac.