Safari on macOS is redirecting one website to another

[ChrisD.]

Currently on 14.3.1. I'll try and explain as best as I can!

I run my UniFi Network Application on my UDM at home, with a local DNS entry pointing unifi.mydomain.com to its local IP address. I also have a Cloudflare DNS entry for the site to enable signed certificates. If I ping unifi.mydomain.com from my work laptop, it resolves correctly to the local IP address of the UDM. If I do a dig or nslookup it returns the Cloudflare Proxy IP addresses (which is completely as expected). I also have other sites.mydomain.com sites at home for things like Home Assistant, Plex etc set up in the exact same way (but pointing to other local IP addresses) and these have no issues. I feel it's important to add that I do have a Cloudflare page rule which redirects the root of mydomain.com to myblog.com.

When I browse to unifi.mydomain.com in Safari, it redirects to myblog.com. When I browse to say plex.mydomain.com it goes to Plex as expected.

It only does this behaviour in Safari. If I use Chrome, Edge, and Firefox, it takes me to the UniFi page as expected. I only get the redirect behaviour using Safari.

Things I've tried:

• Private Window
• Clear all website data
• Clear all history
• Remove all UniFi entires from keychain
• Reboot the Mac
• Checked proxy settings
• Tried wired and wifi

What's odd is that for some random period of time after doing all of the above, especially after a reboot, the page resolves correctly. But it always ends up redirecting to my blog.

It's only my work Mac that does this, all other devices at home are fine so it's entirely possible that it's some work profile/corporate spyware doing this.

Any ideas?

 

[uvarvu]

Do you have permissions to create another user just to rule out anything on your profile?

 

[ChrisD.]

I do, I'll see if I have time today to try that out and report back.

As a test, I disabled the Cloudflare page rules which didn't make a difference, it also appears to be happening on all browsers now.

 

[visibleman]

Sounds like the Mac is querying externally and caching the response - obvious but VPN/Private Relay is disabled and the Mac is querying locally and hasn't got external DNS or DoH set (this needs to be done via a profile, iirc 'ServerURL' key under 'DNSSettings')? Given it's a work device, these are the sort of things can be set via profiles/MDM.
Although i would have thought a local dig/nslookup on the hostname would return the LAN IP rather than an external if the Mac is using a local DNS; Cloudflare/webserver would only show (when local) if you prompted a lookup via an external DNS

Worth killing/flushing DNS and see if that temporarily resolves it -

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

As a test, I disabled the Cloudflare page rules which didn't make a difference, it also appears to be happening on all browsers now.

Cached response; kill DNS on the Mac try again...