---
title: "Encrypted DNS on Mac: DNS over HTTPS and TLS profiles · Kilobat Guides"
url: "https://kilobat.app/guides/encrypted-dns-mac"
description: "Set up DNS over HTTPS or DNS over TLS on a Mac with a configuration profile, and remove it when it causes problems."
---

DNS

# Use encrypted DNS on a Mac

Normal DNS queries are not encrypted. macOS 11 and later can send DNS over HTTPS or TLS when you install a DNS Settings profile.

Applies to: macOS 11 Big Sur and later for encrypted DNS. The profile steps are for macOS 13 Ventura and later. · Checked: 29 October 2026

## Symptoms

- You want DNS queries that other devices on the network cannot read.
- After you install a DNS profile, a hotel or café login page does not open.
- After you install a DNS profile, internal company names stop working.

## Likely causes

- **Plain DNS.** By default, the Mac sends DNS queries to the network's servers without encryption.
- **A DNS Settings profile.** Apple's DNS Settings payload sets an encrypted DNS server with the HTTPS or TLS protocol.
- **A profile that blocks the network's own DNS.** Captive portals and company networks often need their own DNS servers to work.

## How to check

1. Look for DNS profiles. On macOS 15 and later, choose Apple menu > System Settings > General > Device Management.
2. On macOS 13 and 14, choose Apple menu > System Settings > Privacy & Security > Profiles.
3. Show the DNS configuration that macOS uses now.

   ```
   scutil --dns
   ```

## How to fix it

1. Get a profile from your DNS provider. Many providers publish a profile for Apple devices.
2. Open the profile file. macOS adds it to the Downloaded section.
3. On macOS 15 and later, choose Apple menu > System Settings > General > Device Management.
4. On macOS 13 and 14, choose Apple menu > System Settings > Privacy & Security > Profiles.
5. Double-click the profile under Downloaded. Read its contents, then click Install.
6. To stop encrypted DNS, select the profile and click the Remove button.
7. If a login page does not open, remove the profile, log in, then install it again.

## With Kilobat

1. The CLI writes a DNS over HTTPS profile for an HTTPS endpoint that you give. Review it before you install it.

   ```
   kilobat dns-profile https://dns.quad9.net/dns-query > Kilobat-DNS.mobileconfig
   ```
2. Kilobat does not install the profile. Install it with the steps above.

## Questions

**Does the profile work on all networks?**

Apple's documentation says that a profile from an MDM applies only to managed Wi-Fi networks. A profile that you install yourself also applies to cellular networks.

**Can I remove the profile?**

Yes. Select it in Device Management or Profiles, then click the Remove button. Some profiles from an organization only an administrator can remove.

## Sources

- [Apple Developer: DNSSettings payload](https://developer.apple.com/documentation/devicemanagement/dnssettings)
- [Apple Support: Use configuration profiles to standardize settings on Mac computers](https://support.apple.com/guide/mac-help/configuration-profiles-standardize-settings-mh35561/mac)
- [Apple Support: Use configuration profiles (macOS 14 guide)](https://support.apple.com/guide/mac-help/mh35561/14.0/mac/14.0)
- [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

## Related guides

- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing): Public networks often hold all traffic until you sign in on a login page.
- [DNS queries go outside the VPN on a Mac](https://kilobat.app/guides/vpn-dns-leak-mac): With a VPN on, you usually want DNS queries to go to the VPN's servers.
- [Slow DNS on a Mac](https://kilobat.app/guides/slow-dns-mac): Every new site needs a DNS lookup before it can load.
- [Pick a faster DNS](https://kilobat.app/guides/recipes/pick-faster-dns): Slow DNS makes every new site slow to start.