How to Configure Encrypted DNS over HTTPS (DoH) on Mac in macOS Sequoia Using Configuration Profiles

Standard Domain Name System (DNS) queries transmit website lookups across the internet in unencrypted plaintext. Even when browsing HTTPS-secured websites, internet service providers (ISPs), public Wi-Fi operators, and intermediate network nodes can monitor every domain you query, compiling behavioral profiles or redirecting traffic via DNS spoofing and censorship. While entering custom IP addresses in macOS Network Settings routes traffic to alternate resolvers, standard settings still transmit queries over unencrypted port 53. macOS Sequoia includes native, system-wide support for encrypted DNS protocols—specifically DNS over HTTPS (DoH) and DNS over TLS (DoT). Configuring encrypted DNS via signed configuration profiles ensures all application lookups remain cryptographically sealed across every Wi-Fi and ethernet connection.

Understanding DNS over HTTPS (DoH) vs Traditional DNS

Encrypted DNS transforms how macOS resolves hostnames into IP addresses:

• Traditional DNS (Port 53): Transmits raw domain names in plaintext, vulnerable to eavesdropping, packet inspection, and man-in-the-middle (MitM) interception.
• DNS over HTTPS (DoH – Port 443): Encapsulates DNS queries inside standard TLS-encrypted HTTPS traffic. Queries blend indistinguishably with standard web browsing traffic, preventing ISPs and network firewalls from intercepting or filtering DNS lookups.
• System-Wide Protection: Unlike browser-only DoH settings in Chrome or Firefox, macOS configuration profiles enforce encryption across all terminal commands, background system services, and third-party native apps.

Generating a Custom Mobileconfig DNS Profile

macOS utilizes Apple’s standardized .mobileconfig XML payload format to configure network security profiles. You can create your own profile using any text editor.

Step 1: Creating the Profile File

1. Open TextEdit on your Mac.
2. Set the document format to plain text by pressing Cmd + Shift + T.
3. Copy and paste the following configuration template (configured for Cloudflare 1.1.1.1 DoH):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>DNSSettings</key>
            <dict>
                <key>DNSProtocol</key>
                <string>HTTPS</string>
                <key>ServerURL</key>
                <string>https://cloudflare-dns.com/dns-query</string>
                <key>ServerAddresses</key>
                <array>
                    <string>1.1.1.1</string>
                    <string>1.0.0.1</string>
                    <string>2606:4700:4700::1111</string>
                    <string>2606:4700:4700::1001</string>
                </array>
            </dict>
            <key>PayloadDescription</key>
            <string>Configures encrypted DNS over HTTPS using Cloudflare 1.1.1.1</string>
            <key>PayloadDisplayName</key>
            <string>Cloudflare DoH DNS</string>
            <key>PayloadIdentifier</key>
            <string>com.cloudflare.doh.dns</string>
            <key>PayloadType</key>
            <string>com.apple.dnsSettings.managed</string>
            <key>PayloadUUID</key>
            <string>9F4B23A1-7C6B-4E38-92B1-4A8E0D71B3F2</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Encrypted DNS over HTTPS</string>
    <key>PayloadIdentifier</key>
    <string>com.network.doh.profile</string>
    <key>PayloadRemovalDisallowed</key>
    <false/>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>2A6E9B4D-1C3F-4D2A-8B4E-5D3E2F1A0B9C</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Note: If you prefer Quad9 (with automated malware blocking), substitute https://dns.quad9.net/dns-query and IP addresses 9.9.9.9 and 149.112.112.112.

Step 2: Saving the File

1. Save the file as Cloudflare_DoH.mobileconfig to your Desktop or Downloads folder. Ensure the .mobileconfig extension is preserved.

Installing and Enrolling the Profile in macOS Sequoia

For security reasons, macOS Sequoia requires explicit administrative approval before activating custom configuration profiles:

1. Double-click the Cloudflare_DoH.mobileconfig file.
2. macOS displays a desktop notification stating “Profile downloaded. Review the profile in System Settings if you want to install it.”
3. Open System Settings and navigate to Privacy & Security > Profiles.
4. Locate the downloaded profile listed under Downloaded and double-click it.
5. Click Install… and authenticate using your Mac administrator password or Touch ID.
6. The profile status transitions to Verified and activates immediately.

Verifying Encrypted DNS Operation

Confirm that your Mac is routing DNS lookups through the encrypted HTTPS tunnel:

1. Web-Based Leak Verification

Navigate to https://one.one.one.one/help in Safari. The diagnostic test checks your connection:

• Using DNS over HTTPS (DoH): Must report Yes.
• Using DNS over TLS (DoT): Reports No (as DoH is prioritized).
• Connected to 1.1.1.1: Reports Yes.

2. Terminal Verification with Scutil

Inspect active system resolver configurations via Terminal:

scutil --dns

The primary resolver output will display dnsSettings: managed alongside your designated DoH server URL.

Managing and Removing the DNS Profile

If you encounter captive portal login screens at hotels or airports that block encrypted DNS queries:

1. Open System Settings > Privacy & Security > Profiles.
2. Select the DoH profile and click the – (Minus) button to remove it.
3. System DNS reverts instantaneously to local network DHCP defaults without rebooting.

Deploying native configuration profiles in macOS Sequoia provides uncompromising DNS privacy and protection against eavesdropping across every network connection.