<!-- llms-explorer concept facts · https://llms-explorer.com/tree/encrypted-dns-doh-dot-system-settings-changes-in-macos-26-27/ · pack 2026-10-02 · ~935 tokens -->

# Encrypted DNS DoH DoT system settings changes in macOS 26-27

> Source-anchored research for Encrypted DNS DoH DoT system settings changes in macOS 26-27. Run status: COMPLETED.

Parent: [Apple Platform Frontier for Mac Utilities](https://llms-explorer.com/tree/apple-platform-frontier-for-mac-utilities/) · 2 facets · 8 facts · page: https://llms-explorer.com/tree/encrypted-dns-doh-dot-system-settings-changes-in-macos-26-27/

## How it works

- When mDNSResponder gets DoH/DoT designated-resolver info for the current network, it upgrades automatically and the traffic bypasses an active NEDNSProxyProvider; the proxy never sees those queries. Fleet cites Apple feedback FB11963304 as confirming this is intended. DoH on port 443 is indistinguishable from normal HTTPS, so a monitor may report zero DNS activity. (medium confidence) (verified as of 2026-08-15) — [source](https://fleetdm.com/guides/monitor-dns-traffic-on-macos)

## Facts and statements

- Since iOS 16 / macOS Ventura, devices automatically upgrade to encrypted DNS via Discovery of Designated Resolvers (DDR): on joining a network the device issues an SVCB query for _dns.resolver.arpa and, if answered, uses TLS or HTTPS. DDR applies to one network at a time and does not work if the resolver has a private IP address. (high confidence) — [source](https://developer.apple.com/videos/play/wwdc2022/10079/)
- System-wide encrypted DNS can be configured manually with NEDNSSettingsManager in an app or a DNSSettings profile payload; individual apps can opt in with PrivacyContext on NWParameters. Client certificate auth via identityReference on NEDNSSettings is supported since iOS 16 / macOS Ventura. (high confidence) — [source](https://developer.apple.com/videos/play/wwdc2022/10079/)
- macOS 27 adds a DNS settings declarative (DDM) configuration for DoH (RFC 8484 URI template) or DoT (hostname), with optional supplemental match domains, failover to system DNS, client certificates and on-demand rules. It does not require supervision but requires MDM with Device Enrollment or Automated Device Enrollment (not User Enrollment). (medium confidence) (verified as of 2026-10-02) — [source](https://support.apple.com/guide/deployment/dns-settings-declarative-configuration-dep7e19a4b12/web)
- At WWDC26 Apple moved network configurations, including DNS Proxy and DNS Settings, to declarative device management for OS 27, with public release expected fall 2026. (medium confidence) (verified as of 2026-06-11) — [source](https://www.jamf.com/blog/wwdc26-key-takeaways-for-apple-admins/)
- On macOS 26.6.1, a network advertising DoT/DoH via DHCP DNR/DDR (RFC 9463/9462) made mDNSResponder send all queries, including local and split-DNS names, to the network's DoH resolver, overriding Tailscale DNS; scutil --dns still showed the configured servers, so 'dig works, apps don't'. (low confidence) (verified as of 2026-08-15) — [source](https://github.com/tailscale/tailscale/issues/20890)
- After macOS 26.1 (reports from 2025-11-09), installing encrypted-DNS .mobileconfig files fails with 'The "VPN Service" payload could not be installed. The VPN service could not be created.' even though the profile has only a DNS Settings payload. (medium confidence) (verified as of 2025-11-10) — [source](https://github.com/mullvad/encrypted-dns-profiles/issues/18)
- Mitigations for DNS visibility under encrypted DNS include using resolvers without DoH/DoT, answering _dns.resolver.arpa with NXDOMAIN, forcing a corporate encrypted resolver, firewalling known DoH IPs, SNI inspection, or a TLS-intercepting proxy; all are enterprise-side measures unavailable to a sandboxed App Store app. (low confidence) — [source](https://fleetdm.com/guides/monitor-dns-traffic-on-macos)