mac flushdns: Clear DNS Cache on macOS (All Versions)

mac flushdns refers to the Terminal commands that clear the local DNS resolver cache on macOS, forcing the system to discard stale domain-to-IP mappings and fetch fresh records.

# macOS 10.10.4+ (El Capitan, Sierra, High Sierra, Mojave, Catalina, Big Sur, Monterey, Ventura, Sonoma)
sudo killall -HUP mDNSResponder

Syntax

# macOS 10.4 – 10.6 (Tiger, Leopard, Snow Leopard)
sudo dscacheutil -flushcache

# macOS 10.7 – 10.9 (Lion, Mountain Lion, Mavericks)
sudo killall -HUP mDNSResponder

# macOS 10.10.1 – 10.10.3 (Yosemite early)
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

# macOS 10.10.4 – 10.12 (Yosemite late, El Capitan, Sierra)
sudo killall -HUP mDNSResponder

# macOS 10.12.1 – macOS Sonoma 14.x
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

Tested on macOS Sonoma 14.5 with built-in DNS resolver (mDNSResponder).

Usage Examples

After a live DNS change (e.g., updating A record)

# Flush DNS and verify resolution
sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder
ping -c 1 mydomain.com

Forces immediate use of the new IP. Run after switching hosting providers or editing a zone file.

After modifying /etc/hosts

# Requires sudo even when editing hosts; flush afterward
sudo killall -HUP mDNSResponder
# The change is effective almost instantly after the flush.

mDNSResponder caches hosts entries; flushing ensures no stale mapping persists.

Automated daily flush using launchd

# Create a LaunchDaemon to flush DNS at 3am daily
sudo nano /Library/LaunchDaemons/com.flushdns.plist

Add a plist that runs the flush command with ProgramArguments pointing to a script. Not needed in most environments, but useful for lab machines that undergo frequent network reconfiguration.

Troubleshooting & Common Errors

Security and Operational Best Practices

Flushing the DNS cache on macOS with killall -HUP mDNSResponder is a low‑risk administrative task, but it requires proper privilege control. The command inherently runs as root via sudo; follow the principle of least privilege by granting only the exact binary in /etc/sudoers:

• Least‑privilege IAM: Create a dedicated admin user or add an entry like username ALL=(ALL) NOPASSWD: /usr/bin/killall -HUP mDNSResponder to avoid exposing a full root shell. For older macOS (10.5–10.6) use sudo /usr/bin/dscacheutil -flushcache similarly.
• Authentication knobs: macOS enforces sudo authentication via the authorization database. To require a password even for NOPASSWD entries, set timestamp_timeout = 0 in /etc/sudoers.d/timeout. The sudo command itself logs to /var/log/system.log (or unified log).
• Audit & logging hooks: macOS uses the unified logging system. Monitor mDNSResponder flushes with native log commands. For persistent audit trails, enable auditd.

Operationally, flush only after network or DNS server changes. The alias alias flushdns='sudo killall -HUP mDNSResponder' reduces typos. Verify cache size before and after with dscacheutil -statistics. The command completes in under 1 second. Error code 1 indicates no process was killed (e.g., mDNSResponder not running).

# Real‑time stream of mDNSResponder HUP events
sudo log stream --predicate 'process == "mDNSResponder" AND eventMessage contains "HUP"' --style syslog

# View flushes in the last hour
log show --predicate 'process == "mDNSResponder" AND eventMessage contains "HUP"' --last 1h --info

# Enable auditd for persistent audit records (if not already active)
sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist
sudo audit -s

Note: journalctl is unavailable on macOS; use the log command. The sudoers configuration strictly limits the allowed binary, enforcing least privilege.

Multi-Cloud / Cross-Platform Equivalents

Frequently Asked Questions