Mac OS X/DNS and .local

Did you know Mac OS X has problems with *.local DNS records?

Surprise, surprise, .local is used for Rendezvous/Zeroconf, up to the point where /etc/resolver/local (which is symlinked from 254.169.in-addr.arpa contains a multicast DNS entry:

nameserver 224.0.0.251
port 5353
timeout 1

So, if like me, your company used company.local for its internal DNS, you're royally screwed. No, adding the domain suffix to the domain search box in Preferences doesn't work.

Note: Please stop sending me e-mail on this, since they already know it's a mistake and use internal.company.com instead (if you bother to check the page history, it pre-dates February 2003, so this has already been discussed to death).

Nevertheless, the fact that the resolver will not let a manually-configured/DHCP-assigned DNS domain suffix take precedence over .local is, in my view, a mistake on Apple's part. This seens to have been fixed on Panther, but I have no reason to connect my Mac to the company network anymore (and even if I did, they changed the DNS layout and I cannot reproduce it).

The symptoms are as follows: doing an nslookup for "intranet.company.local" works, trying to browse to it or ping it fails with a lookup error. Wierd, huh? Took me a while to figure out that the resolver (lookupd) was at fault here.

Since I use a NAT/tunneling gateway at 192.168.0.1 to reach my company intranet (which has a DNS relay), I hacked /etc/resolver/local to read:

nameserver 192.168.0.1
port 53
timeout 1

And nudged lookupd with:

sudo kill -1 `cat /var/run/lookupd.pid`

This effectively removes the multicast DNS responder and forces you to resolve *.local through the DNS server at 192.168.0.1. It works for my specific case, but feels like a gigantic kludge.

Adding another file for "company.local" ought to work, but I couldn't get it to before 10.3. Nevertheless, this hint apparently works now.

I had spent quite some time poring over the lookupd manpage (which goes into great detail as to what exactly lookupd can query, NetInfo and file-based configurations, but does not tell you that .local actually means EVERYTHING to the left of .local).

(Note that my fix effectively breaks Rendezvous, and that I have not tested this hint, since I don't have an issue with this anymore).