Skip to main content

Set Up a Local Dev Domain (.test) with dnsmasq

note

This didn't end up being done exactly like this — a Docker container running dnsmasq was used instead.

To set up Dnsmasq on macOS for split DNS (simultaneous LAN/VPN resolution): install Dnsmasq via Homebrew, configure it to forward specific VPN domains to the VPN DNS server, and set up a resolver file for macOS to use the local Dnsmasq. This forces traffic for company domains through the VPN, while other traffic uses the default provider.

Step-by-step configuration​

Install Dnsmasq​

Using Homebrew:

brew install dnsmasq

Configure Dnsmasq​

Edit the configuration file (usually /opt/homebrew/etc/dnsmasq.conf on Apple Silicon, or /usr/local/etc/dnsmasq.conf on Intel):

# Set to listen locally
listen-address=127.0.0.1

# Define your VPN DNS server and specific domains
# Example: Send all requests for *.company.com to 10.0.0.1
server=/company.com/10.0.0.1

# Alternatively, for all VPN traffic through specific VPN IP
# server=/vpn.domain.com/192.168.1.1

# Use Google for everything else (or leave commented for system defaults)
server=8.8.8.8

Start the service​

sudo brew services start dnsmasq

Configure macOS to use Dnsmasq​

Create a resolver directory and add an entry for your company domain:

sudo mkdir -p /etc/resolver
# Name the file after your VPN domain, e.g. 'company.com'
sudo bash -c 'echo "nameserver 127.0.0.1" > /etc/resolver/company.com'

Test resolution​

Disconnect and reconnect your VPN, then run:

scutil --dns

You should see your local company.com entries pointing to 127.0.0.1.

Key considerations​

  • VPN domain: If your VPN uses a special suffix (like .corp or .local), use that in the filename inside /etc/resolver/.
  • VPN reconnect: If DNS breaks after reconnecting, you may need to restart dnsmasq: sudo brew services restart dnsmasq.
  • Flush cache: Use sudo dscacheutil -flushcache to apply changes.

Sources​