2026-05-18 DNS and HTTP client cache after switching ProxyMac Mac mini region: when APIs still exit the wrong POP

You finally moved your SSH default from a rented Mac mini M4 in Tokyo to Singapore, or you rotated ssh -D SOCKS per proxy exit node patterns—yet vendor dashboards still show JP POP headers, latency histograms refuse to move west, and QA insists “the region flag did not flip.” The mini is not lying: your laptop’s resolver and HTTP stacks cached the previous universe. This field guide delivers (1) an audience filter for teams who must prove path changes, (2) a symptom matrix separating DNS TTL myths from warm HTTP/2 pools, (3) a four-layer cache cake (OS, browser, language runtime, negative DNS), (4) a nine-step flush runbook with numeric guardrails, (5) copy-paste curl --resolve receipts, (6) OpenClaw corporate proxy footguns when DNS and HTTP_PROXY disagree, plus pitfalls around HTTPSVC and negative caching. Pair with split DNS resolver failures and IPv6 Happy Eyeballs before opening vendor tickets. For path picking use MTR region diagnostics; for SKUs use pricing; for SSH receipts use help.

Who must actively bust DNS and HTTP caches after a ProxyMac region change

Anyone whose success criteria include HTTP response headers (cf-ray, x-amz-cf-pop, server-timing), TLS session tickets bound to an old edge, or SaaS admin panels that display source country inferred from resolver path—not merely “SSH latency dropped.” If you only ever pinged the mini and never called public APIs through SOCKS or split-tunnel VPN, you may skip this guide; if you benchmark CDN or LLM edges from the laptop while the mini moved, read on.

• Quantitative gate: if curl -s https://ipinfo.io/json shows the new country but curl -sI https://api.vendor.example still prints a POP code from the prior continent within 10 minutes, you have a client cache class bug—not a ProxyMac routing defect.
• Automation gate: CI runners that reuse long-lived Node or Python processes inherit in-process DNS pools; they need explicit recycle after region rotation.
• Security gate: corporate DNS over HTTPS profiles on macOS may override your mini move until the VPN client refreshes policy—see resolver article.

Symptom matrix: wrong POP but HTTP 200 and “healthy” pings

Observable	Likely layer	First action
dig shows new AAAA, vendor header still old POP	HTTP/2 connection pool or TLS session cache	Restart browser profile or add --http1.1 once to force new TCP
dig still shows old RRSet seconds after TTL expiry	mDNSResponder / OS cache	Flush resolver cache where permitted; verify with dscacheutil -q host -a name api.vendor.example
Only Java or JVM services wrong; curl correct	JVM InetAddress cache	Set networkaddress.cache.ttl=0 for test JVMs only; restart service
Intermittent NXDOMAIN after typo fix	Negative caching	Wait negative TTL or switch resolver temporarily

Layer cake: OS resolver vs browser vs runtime vs connection pools

Modern stacks resolve names more than once per process lifetime. On macOS, mDNSResponder caches positive and negative answers subject to RR TTL and platform policy. Chromium-derived browsers add another cache tier and reuse QUIC or HTTP/3 sessions when UDP paths survive region changes. Node’s dns.lookup may call getaddrinfo once per pool unless you configure lookup hooks. OpenClaw gateways that reuse a single fetch or undici pool inherit the same hazard—after you move the mini, restart the gateway process so outbound TLS handshakes rebind to the new resolver view, especially when combined with corporate HTTP_PROXY encoding.

Nine-step cache flush runbook

1. Baseline headers: capture curl -sI for three vendor endpoints before touching DNS.
2. Prove SSH path: confirm you are on the intended mini with scutil --get ComputerName over SSH—not just prompt text.
3. Resolver flush: on supported macOS builds, run the documented flush command your security team approves—never guess admin passwords in tickets.
4. Browser cold start: fully quit Chromium/Firefox/Safari; disable “reopen windows” for one cycle.
5. SOCKS rebind: kill old ssh -D PIDs; verify with lsof -nP -iTCP:1080 before opening a new tunnel per SSH stability guide.
6. Runtime recycle: restart Node, Python, or JVM workers in CI—not only the job step shell.
7. Control experiment: use curl --resolve (see next section) to prove the vendor edge reachable from the new IP class.
8. Soak: run 200 sequential HTTPS probes at 2 rps and confirm POP codes converge.
9. Rollback note: if flush breaks captive portals, document VPN reconnect order per guest Wi-Fi guide.

curl --resolve and dscacheutil recipes

When you need to bypass stale answers without editing /etc/hosts, pin the authoritative IP for a single command:

curl -v --resolve api.vendor.example:443:203.0.113.44 https://api.vendor.example/healthz

Pair with dscacheutil -q host -a name api.vendor.example on macOS to print what the userland cache believes right now. If dscacheutil disagrees with dig @8.8.8.8, your split-tunnel VPN or DoH client is still steering—return to resolver triage.

OpenClaw and outbound HTTP clients: cache footguns behind launchd

LaunchAgents that call model APIs often keep one undici or axios agent alive for hours. After you migrate the mini between regions, the process may still reuse DNS answers obtained at boot unless you recycle the event loop worker. Combine recycle with explicit NO_PROXY hygiene from HTTP proxy launchd article so localhost MCP traffic does not inherit stale corporate resolver paths.

Pitfalls: negative caching, SVCB/HTTPS records, and anycast drift

NXDOMAIN answers cache negatively—your first typo poisons automation for minutes. New HTTPS RR types can steer clients to QUIC endpoints that differ from A records; if your tooling only watches A/AAAA, you will chase ghosts. Anycast fronts may also keep TCP sessions pinned to a distant POP even when BGP shifts—only a new connection proves movement.

dig api.vendor.example HTTPS +short

FAQ

Does moving from JP to SG on ProxyMac require waiting for DNS TTL alone? Authoritative TTL governs global propagation, but laptops retain local caches and warm HTTP pools. Flush layers in order instead of only waiting TTL.

Why does curl show the new region while Chrome still shows the old CDN country? Different stacks: curl often opens a fresh TCP connection while Chrome reuses HTTP/2 or QUIC sessions tied to the old edge.

Is curl --resolve safe for production smoke tests? It is a diagnostic override for single commands—excellent for proofs, unsafe if committed to automation without rotation monitoring.

Why ProxyMac Mac mini is the right anchor for cross-region cache experiments

Rented Mac mini M4 nodes in HK / JP / KR / SG / US give you predictable egress IP classes per region so you can correlate POP headers with geography, native macOS resolver behavior identical to developer laptops, and single-tenant CPU for long curl soak tests without noisy neighbors. When cache math is validated here, you promote the same playbooks through pricing-transparent second nodes instead of guessing on ephemeral CI IPs.