How to Configure Encrypted DNS and Private Relay Fallbacks in macOS Using networksetup

DNS queries routed over unencrypted transport protocol UDP port 53 expose every visited domain to local network snooping, ISP surveillance, and man-in-the-middle tampering. Modern macOS releases incorporate native encrypted DNS support via DNS over HTTPS (DoH) and DNS over TLS (DoT), which operate alongside Apple iCloud Private Relay. System administrators and power users can configure, audit, and automate resilient DNS fallbacks using the command-line utility networksetup.

Architectural Overview of macOS DNS Resolution

Network resolution in macOS follows a tiered resolution architecture managed by mDNSResponder:

• NetworkConfiguration Profiles: System-wide encrypted DNS configurations deployed via Apple mobileconfig profiles enforce DoH or DoT across all network interfaces.
• iCloud Private Relay: Dual-hop ingress and egress proxies route Safari web traffic, masking client IP addresses and encrypting DNS lookups before egress.
• networksetup Fallbacks: The native networksetup tool configures baseline resolver endpoints applied when encrypted tunnels or profiles are disabled or traversing captive portals.

Identifying Active Network Services

Before modifying DNS resolvers, discover the exact network service names configured on your Mac:

networksetup -listallnetworkservices

Identify your active primary interface (typically Wi-Fi, Ethernet, or Thunderbolt Ethernet). To verify which service currently routes default traffic, check interface routing:

route get default | grep interface

Configuring Baseline Resolvers via networksetup

Assign high-performance, privacy-focused upstream DNS resolvers (such as Cloudflare 1.1.1.1 or Quad9 9.9.9.9) as base resolvers:

# Configure Quad9 encrypted-ready IPv4 resolvers for Wi-Fi
sudo networksetup -setdnsservers "Wi-Fi" 9.9.9.9 149.112.112.112

# Configure IPv6 upstream addresses
sudo networksetup -setdnsservers "Wi-Fi" 9.9.9.9 149.112.112.112 2620:fe::fe 2620:fe::9

To verify the assigned configuration:

networksetup -getdnsservers "Wi-Fi"

Deploying a Native DoH Profile with Fallback Protection

While networksetup defines the static resolver addresses, enforcing end-to-end DoH encryption requires deploying a Configuration Profile with a DNS Settings payload:

1. Create an unsigned configuration payload named doh-resolver.mobileconfig specifying:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>PayloadContent</key>
       <array>
           <dict>
               <key>DNSSettings</key>
               <dict>
                   <key>DNSProtocol</key>
                   <string>HTTPS</string>
                   <key>ServerURL</key>
                   <string>https://dns.quad9.net/dns-query</string>
                   <key>ServerAddresses</key>
                   <array>
                       <string>9.9.9.9</string>
                       <string>149.112.112.112</string>
                   </array>
               </dict>
               <key>PayloadType</key>
               <string>com.apple.dnsSettings.managed</string>
               <key>PayloadIdentifier</key>
               <string>com.digitash.dns.doh</string>
               <key>PayloadUUID</key>
               <string>3D8B1C84-912A-4B60-A6E5-5E1B51234567</string>
               <key>PayloadVersion</key>
               <integer>1</integer>
           </dict>
       </array>
       <key>PayloadDisplayName</key>
       <string>Encrypted DoH Resolver</string>
       <key>PayloadIdentifier</key>
       <string>com.digitash.profile.dns</string>
       <key>PayloadType</key>
       <string>Configuration</string>
       <key>PayloadUUID</key>
       <string>A842E9D1-3BC9-44F2-87F2-48419E987654</string>
       <key>PayloadVersion</key>
       <integer>1</integer>
   </dict>
   </plist>

2. Install the profile using the command line:

   sudo /usr/bin/profiles install -path doh-resolver.mobileconfig

3. Approve the installation prompt in System Settings > Privacy & Security > Profiles.

Testing DNS Resolution and Verifying Encryption

Verify that queries route over encrypted sockets without plaintext leakage:

# Query via scutil to check active resolver state
scutil --dns

# Flush the local mDNSResponder cache
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

# Test query resolution
dscacheutil -q host -a name digitash.com

If connecting to captive Wi-Fi networks (such as hotel or airport portals), macOS automatically falls back to DHCP-provided DNS until the authentication captive portal clears, after which encrypted DoH resumes transparently.