FULL AI ANALYSIS

macOS Mail stops fetching new messages only when connected to corporate VPN with split DNS

Generated Oct 3, 2026, 12:35:03 AM

Analysis summary

Symptoms point to an application-level network-resolution or socket-routing mismatch when the system resolver returns an internal IP over the VPN. Terminal tools using the system resolver work which suggests the internal IP and route are reachable. The Mail app likely uses a DNS/connection path that ends up routed differently (for example, preferring IPv6, hitting a local proxy, or using cached negative entries via the OS resolver), or Mail's background connection is being blocked by the VPN client or per-app firewall (Network Extension) when using the system network service. The fact other mail clients succeed indicates a Mail-specific interaction with macOS networking (CFNetwork) or app entitlements/Network Extension policies pushed by the VPN.

Possible causes

VPN client installs Network Extension or content filter that blocks or intercepts background socket calls from Mail but allows interactive Terminal clients

75%

Per-app VPN or proxy-policy on the gateway prevents traffic from Apple's Mail process (com.apple.mail) while allowing other user agents

30%

Split-DNS returns internal hostname resolving to internal IP that is reachable only via a specific route; Mail's background sockets may be created before route/DNS update completes, leading to persistent cached failure

25%

Apple Mail using CFNetwork path that prefers IPv6 while the VPN only routes IPv4 internal addresses -> connection attempts fail silently

10%

Suggested fixes

Diagnostic step 1

Capture Mail network traffic without exposing credentials: use tcpdump to capture IP/port/connect attempts to the IMAP server while reproducing the failure (sudo tcpdump -i <iface> host <mail-ip> and port 993) and inspect whether connections are attempted and whether TCP handshake succeeds

Diagnostic step 2

Start Apple Mail from Terminal with Console logging enabled: open Console.app → start a system log session; then launch Mail from Terminal (open -a Mail) and reproduce; collect CFNetwork logs shown in Console for clues

Diagnostic step 3

Temporarily test Mail against the mail server over an SSH SOCKS proxy to bypass VPN resolver: ssh -D 1080 user@bastion and configure a test Mail account to use localhost:1080 as SOCKS (or use network.proxy.socks in a test client) to see if behavior changes (do not put production credentials in logs)

Diagnostic step 4

Create a new user account on the Mac and connect VPN there to confirm whether Mail's background service permissions or per-user caches cause the issue

Diagnostic step 5

Check VPN client logs and System Preferences → Profiles for any Network Extension, per-app VPN, or content-filter policies; temporarily disable the VPN client and create a manual IKEv2 configuration (if permitted) to compare behavior without the third-party client (do not change company policy without approval) - escalate to VPN/admin if policies appear to block com.apple.mail or if Network Extension behavior is present and cannot be altered by the end user.

Contact • Help • API Docs • Careers • Terms • Privacy • Cookies • Ads