For over a year every time I restarted my computer, the internet didn’t work. The trouble was, and I forgot how I even figured it out at first, was that the DNS Server was set 127.0.0.1 on my WiFi settings (regardless of what network).

Screenshot of a Wi-Fi settings menu on a Mac, showing the DNS server address set to 127.0.0.1.

I’d come in here, delete it, and they would default back to whatever they default to, some other numbers.

Screenshot of Wi-Fi settings showing DNS server configuration on a Mac. The connected network is named 'Old Time Road', with DNS server fields displayed.

So I’d either leave them like that, which immediately fixed the internet, or set 1.1.1.1, Cloudflare’s DNS, as I have it in my head that it’s possibly “faster”. Either way, it worked, but every time I restarted the machine, it was back to 127.0.0.1 and broken. I tried all kinds of jiggery-pokery to get it to stick, but it wouldn’t. I also tried every month or so to sort it out, and always failed.

The good news is that it’s fixed!

The lead came from my co-worker Stephen finding a Reddit thread that mentions an app called NextDNS that does that so it can handle DNS itself. I think I maybe did give NextDNS a shot at one point, but didn’t like something about it (or had trouble), and thought I had fully uninstalled it.

Obviously: I did not have it fully uninstalled. It was nowhere to be found in my Applications folder or through search, but a vestige of it did remain.

I ended up using this very strange app called Etrecheck where you type in your problem and it does system diagnosis stuff and tries to figure out your issue. It was when nextdns showed up in the results of running that as an “Unsigned File” that was “running” and “probably malicious” that I put 2 and 2 together.

A computer screen displaying the EtreCheck app interface, highlighting an 'Unsigned Files' section with information about a system launch daemon labeled 'nextdns', indicating it is running and marked as 'probably malicious'.

Rooting out this file (and an alias to it) and deleting it made the problem go away.