Encrypted DNS DoH DoT system settings changes in macOS 26-27
Parent: Apple Platform Frontier for Mac Utilities · Published reference · snapshot 2026-10-02
↓ Facts as markdownall context files
Source-anchored research for Encrypted DNS DoH DoT system settings changes in macOS 26-27. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- When mDNSResponder gets DoH/DoT designated-resolver info for the current network, it upgrades automatically and the traffic bypasses an active NEDNSProxyProvider; the proxy never sees those queries. Fleet cites Apple feedback FB11963304 as confirming this is intended. DoH on port 443 is indistinguishable from normal HTTPS, so a monitor may report zero DNS activity. (medium confidence) (verified as of 2026-08-15) [source]
Facts and statements
- Since iOS 16 / macOS Ventura, devices automatically upgrade to encrypted DNS via Discovery of Designated Resolvers (DDR): on joining a network the device issues an SVCB query for _dns.resolver.arpa and, if answered, uses TLS or HTTPS. DDR applies to one network at a time and does not work if the resolver has a private IP address. (high confidence) [source]
- System-wide encrypted DNS can be configured manually with NEDNSSettingsManager in an app or a DNSSettings profile payload; individual apps can opt in with PrivacyContext on NWParameters. Client certificate auth via identityReference on NEDNSSettings is supported since iOS 16 / macOS Ventura. (high confidence) [source]
- macOS 27 adds a DNS settings declarative (DDM) configuration for DoH (RFC 8484 URI template) or DoT (hostname), with optional supplemental match domains, failover to system DNS, client certificates and on-demand rules. It does not require supervision but requires MDM with Device Enrollment or Automated Device Enrollment (not User Enrollment). (medium confidence) (verified as of 2026-10-02) [source]
- At WWDC26 Apple moved network configurations, including DNS Proxy and DNS Settings, to declarative device management for OS 27, with public release expected fall 2026. (medium confidence) (verified as of 2026-06-11) [source]
- On macOS 26.6.1, a network advertising DoT/DoH via DHCP DNR/DDR (RFC 9463/9462) made mDNSResponder send all queries, including local and split-DNS names, to the network's DoH resolver, overriding Tailscale DNS; scutil --dns still showed the configured servers, so 'dig works, apps don't'. (low confidence) (verified as of 2026-08-15) [source]
- After macOS 26.1 (reports from 2025-11-09), installing encrypted-DNS .mobileconfig files fails with 'The "VPN Service" payload could not be installed. The VPN service could not be created.' even though the profile has only a DNS Settings payload. (medium confidence) (verified as of 2025-11-10) [source]
- Mitigations for DNS visibility under encrypted DNS include using resolvers without DoH/DoT, answering _dns.resolver.arpa with NXDOMAIN, forcing a corporate encrypted resolver, firewalling known DoH IPs, SNI inspection, or a TLS-intercepting proxy; all are enterprise-side measures unavailable to a sandboxed App Store app. (low confidence) [source]
Children
- No children recorded.