When the Mac cannot spell github.com - one DNS outage across five logsHands-on

Five red alerts on Sunday morning had one cause: the Mac could not resolve hostnames. The error text tells you which of three worlds you are in before you touch anything.

Every outbound call your automations make - Anthropic, GitHub, the reMarkable cloud, ntfy, the weather API - starts by turning a name like api.anthropic.com into an address. When that lookup fails the Mac reports it as ENOTFOUND or 'nodename nor servname provided, or not known'. Nothing further happens; the retry loop just hits the same wall.

Three worlds, three signatures. Network: ENOTFOUND, nodename, ECONNREFUSED, timeouts on every host at once. Provider: HTTP 429, 5xx, 'overloaded' - one host misbehaving while others work. Account: 'usage limit' or 'rate limit reached' in the API response, returning in seconds. The 9-11 incident was the third kind; 9-20 was the first.

The fallbacks behaved correctly. plan-day published its data-only brief, the nightly skipped the render leg and let the verify leg alert, the sweep committed locally and failed only on push. What was wrong was that the machine could not reach the internet, which no wrapper can fix.

Worked example

Read one outage across the logs, then ask the Mac how it resolves names right now.

cd /Users/tom/Claude
grep -l 'ENOTFOUND\|nodename nor servname' PDB/logs/*.log JobHunt/logs/sweep.log
grep -c 'cloud unreachable' PDB/logs/remarkable-returns.log

scutil --dns | head -20
dscacheutil -q host -a name github.com

• Lists every log that saw the same DNS failure on 9-20 - same string, same window, one cause.
• 166 on Sunday evening; each is one 15-minute poll that could not reach the cloud.
• Shows the resolvers the Mac is using (usually the router). If this list is empty or points somewhere odd, that is the problem.
• A working lookup prints an ip_address line. No line means DNS is still broken.

Gotchas

• A 'usage limit' error returns in about two seconds and clears on the clock; a DNS failure also returns fast but clears only when the network does. Read the text, not the speed.
• The nightly's 'network not confirmed after 300s; proceeding anyway' line is the early warning - it fired at 07:47 on 9-20.