outboundctl dns

outboundctl dns: list encrypted DNS providers, check status, run a lookup test, and request exceptions, the plaintext DNS block, per-profile pauses and the captive-portal pause.

Outbound 1.3.0 · Updated 24 October 2026

outboundctl dns reads and changes the same encrypted DNS settings as Settings › DNS. Outbound hands these settings to macOS, and macOS sends the lookups.

Reading

Command	What it shows
`dns providers [--json]`	The bundled provider catalogue: IDs, names, operators, legal jurisdictions and filtering. `--json` includes the full entries, with logging-policy summaries, privacy-policy links, endpoints and sources
`dns status`	The DNS status, what it covers, and the plaintext DNS attempts that went around it in the last 24 hours
`dns test [domain]`	Runs A and AAAA lookups through the system and the encrypted resolver, and reports what the filter observed
`dns exceptions list`	The DNS exceptions in effect

dns test must be run from the copy of outboundctl inside Outbound.app. status and exceptions list accept --json.

The provider IDs are quad9, cloudflare, google, nextdns, dns4eu (DNS4EU Protective) and controld (Control D Unfiltered). The catalogue is bundled with Outbound; listing it does not contact the providers.

Changing

Each of these is a request that follows outboundctl changes in Settings › Security.

Command	What it requests
`dns configure [--provider <id>] [--protocol https\|tls] [--profile-id <id>]`	Turn on encrypted DNS with a provider and protocol. NextDNS needs `--profile-id`, six hexadecimal characters
`dns configure --off`	Turn encrypted DNS off, keeping your choices
`dns exceptions add <domain> [--profile <name>] [--note <text>] [--temporary]`	Skip encryption for a domain and its subdomains, in every profile or one. `--temporary` ends it after 15 minutes
`dns exceptions remove <domain\|id> [--profile <name>]`	Remove an exception
`dns block-plaintext on\|off`	Block apps that send unencrypted DNS themselves while encryption is on
`dns disable-profile <name\|uuid> on\|off`	Turn encrypted DNS off, or back on, while one profile is active
`dns captive-portal 15m`	Turn encryption off for 15 minutes so a hotel or airport sign-in page can load

outboundctl dns providers --json
outboundctl dns configure --provider dns4eu --protocol https
outboundctl dns exceptions add intranet.example.com --note "Office network"

Removing an exception that doesn’t exist exits 66 with “No matching DNS exception.”