DNS

Use encrypted DNS on a Mac

Normal DNS queries are not encrypted. macOS 11 and later can send DNS over HTTPS or TLS when you install a DNS Settings profile.

Applies to: macOS 11 Big Sur and later for encrypted DNS. The profile steps are for macOS 13 Ventura and later.Checked: 29 October 2026

Symptoms

  • You want DNS queries that other devices on the network cannot read.
  • After you install a DNS profile, a hotel or café login page does not open.
  • After you install a DNS profile, internal company names stop working.

Likely causes

  • Plain DNS. By default, the Mac sends DNS queries to the network's servers without encryption.
  • A DNS Settings profile. Apple's DNS Settings payload sets an encrypted DNS server with the HTTPS or TLS protocol.
  • A profile that blocks the network's own DNS. Captive portals and company networks often need their own DNS servers to work.

How to check

  1. Look for DNS profiles. On macOS 15 and later, choose Apple menu > System Settings > General > Device Management.

  2. On macOS 13 and 14, choose Apple menu > System Settings > Privacy & Security > Profiles.

  3. Show the DNS configuration that macOS uses now.

    scutil --dns

How to fix it

  1. Get a profile from your DNS provider. Many providers publish a profile for Apple devices.

  2. Open the profile file. macOS adds it to the Downloaded section.

  3. On macOS 15 and later, choose Apple menu > System Settings > General > Device Management.

  4. On macOS 13 and 14, choose Apple menu > System Settings > Privacy & Security > Profiles.

  5. Double-click the profile under Downloaded. Read its contents, then click Install.

  6. To stop encrypted DNS, select the profile and click the Remove button.

  7. If a login page does not open, remove the profile, log in, then install it again.

With Kilobat

  1. The CLI writes a DNS over HTTPS profile for an HTTPS endpoint that you give. Review it before you install it.

    kilobat dns-profile https://dns.quad9.net/dns-query > Kilobat-DNS.mobileconfig

  2. Kilobat does not install the profile. Install it with the steps above.

Questions

Does the profile work on all networks?

Apple's documentation says that a profile from an MDM applies only to managed Wi-Fi networks. A profile that you install yourself also applies to cellular networks.

Can I remove the profile?

Yes. Select it in Device Management or Profiles, then click the Remove button. Some profiles from an organization only an administrator can remove.

Sources

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.