Nice post @dallendoug. Would select from dns_resolvers another option ? osquery> SELECT * FROM plist WHERE path = '/Library/Preferences/SystemConfiguration/preferences.plist' AND value IN ('8.8.8.8'); +-----------------+------------------------------------------------------------+---------+------------------------------------------------------------+ | key | subkey | value | path | +-----------------+------------------------------------------------------------+---------+------------------------------------------------------------+ | NetworkServices | XXXXXXXXX/DNS/ServerAddresses/0 | 8.8.8.8 | /Library/Preferences/SystemConfiguration/preferences.plist | +-----------------+------------------------------------------------------------+---------+------------------------------------------------------------+ osquery> select * from dns_resolvers WHERE address IN ('8.8.8.8'); +----+------------+---------+---------+---------+ | id | type | address | netmask | options | +----+------------+---------+---------+---------+ | 0 | nameserver | 8.8.8.8 | 32 | 1729 | +----+------------+---------+---------+---------+ osquery>