dscacheutil -flushcache: macOS DNS Flush Troubleshooting

macbook flush dns clears the system-wide DNS resolver cache on macOS by terminating and restarting the mDNSResponder daemon with a SIGHUP signal, forcing fresh DNS lookups from configured servers.

Syntax

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Tested on macOS Ventura 13.x, Monterey 12.x, Big Sur 11.x, and older releases back to OS X 10.11 El Capitan using the built-in mDNSResponder.

Options and Flags

When to Flush DNS

Use the combined command after DNS record changes (domain propagation), site migrations, or when browsers and ping return stale IP addresses. The two commands together clear both the Directory Services cache and the mDNSResponder daemon cache, covering macOS 10.11 through Sonoma 14 on Intel and Apple Silicon.

Usage Examples

Example 1: Flush DNS after domain propagation

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

After changing DNS records for a domain, this command forces the MacBook to query the authoritative nameservers immediately instead of using stale cached entries. Useful during migration or failover scenarios.

Example 2: Diagnose “host not found” errors

ping -c 3 example.com
# If ping shows outdated IP, run:
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
ping -c 3 example.com

When a domain resolves to an old IP in the browser or terminal, flushing the cache confirms whether the issue is client-side vs server-side. Combines DSD cache and mDNSResponder reset for full clearance.

Example 3: Automate with sudoers (no password prompt)

# Add to /etc/sudoers.d/flushdns (using visudo):
# %admin ALL=(ALL) NOPASSWD: /usr/bin/dscacheutil, /usr/bin/killall
# Then run as non-root:
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

For deeper DevOps integration, configure passwordless sudo for these two binaries. This allows scripts or monitoring tools (e.g., Ansible, shell cron) to flush DNS without interactive password entry.

Troubleshooting & Common Errors

Multi-Platform Comparison

Performance Considerations and Tuning

Flushing the DNS cache on macOS via sudo killall -HUP mDNSResponder is a quick fix for stale records, but it does not address underlying performance issues. To tune DNS resolution, adjust system-level knobs that govern UDP buffer sizes, query timeouts, and cache behavior.

• UDP receive buffer (net.inet.udp.recvspace) – controls how much data the kernel can buffer for incoming DNS responses. View with sysctl net.inet.udp.recvspace; default is 42080 bytes on macOS. Increase to reduce packet drops under heavy load.
• DNS query timeout – managed by the resolver. Check current timeout with scutil --dns (look for “options timeout:”). The default is 5 seconds. Adjust via networksetup -setdnsservers (does not directly change timeout; instead, use a custom resolver configuration in /etc/resolver/).
• Cache statistics – examine cache hit rates using dscacheutil -statistics. A low hit rate may indicate the cache size is too small. Apple’s mDNSResponder cache size can be tuned via a launchd plist (e.g., --CacheEntries flag), though manual editing of the plist is required.

Example of viewing current buffer sizes and MTU (which affects maximum datagram size for DNS over UDP):

sysctl net.inet.udp.recvspace net.inet.udp.maxdgram net.inet.tcp.mssdflt

Refer to Apple’s Kernel Programming Guide and the DNS Resolver System Preferences Manual for authoritative parameter descriptions. Tuning these values improves DNS responsiveness without relying solely on cache flushes.

Security and Operational Best Practices

Flushing the DNS cache on macOS requires administrative privileges, making least‑privilege a core concern. The command sudo killall -HUP mDNSResponder must be run as root — but users should never remain in a root shell. Instead, execute the flush command only when needed and exit any elevated session immediately after.

• Authentication & Privilege: Always use sudo interactively; avoid scripting sudo with hardcoded credentials. Verify that only trusted users have /etc/sudoers entries for killall or dscacheutil.
• Audit & Logging: macOS does not log the flush itself, but you can monitor mDNSResponder activity. Use log show to capture related events.

# Perform a safe flush
sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder

# After flushing, review recent mDNSResponder logs (last 10 minutes)
log show --predicate "process == 'mDNSResponder'" --last 10m --info

# Check for repeated unauthorized flush attempts in unified log
sudo log show --predicate 'eventMessage contains "flush"' --last 1h

Regularly monitor /var/log/system.log for mDNSResponder restarts. Combine with auditd (via sudo audit trails) to capture sudo invocations. This approach provides retroactive visibility into DNS‑cache resets without introducing cloud‑specific IAM — the local best practice is to limit sudo scope and log all privileged executions.

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

sudo killall -HUP mDNSResponder

sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder && sudo networksetup -setdnsservers Wi-Fi Empty

sudo launchctl list | grep mDNSResponder

alias flushdns='sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder; echo "DNS flushed."'