DNS encryption
Outbound’s encrypted DNS setting, what it configures in macOS, how it shows whether lookups are really encrypted, and what it deliberately does not do.
Settings › DNS turns on encrypted DNS through macOS’s own encrypted DNS settings. Outbound hands your choices to macOS and macOS sends the lookups. Outbound isn’t a DNS proxy, and it doesn’t see the names you look up. The background agent never installs this configuration. Only the app does, and the DNS page is absent on a Mac where the feature isn’t available.
Encrypting lookups hides which names this Mac looks up from the network it is on. On its own it doesn’t change what Outbound allows or blocks. If you also turn on Block plaintext DNS from apps while encryption is on, Outbound blocks apps that send unencrypted DNS themselves.
Who it covers
Section titled “Who it covers”The page says it plainly: “On for apps that use macOS name lookup. Apps with their own resolvers, VPNs and DNS exceptions may bypass this setting.” Most apps ask macOS to look up names, and those lookups are encrypted. Some don’t:
- An app with its own resolver can send DNS straight to a server, encrypted or not.
- A VPN can carry DNS inside its tunnel, to its own servers.
- A domain you add as an exception uses the network’s DNS server on purpose.
Because the filter sees each app’s connections, Outbound can tell when an app sends DNS around the setting. Those apps are listed on the DNS page under Not covered, with how many attempts each made in the last 24 hours. Outbound stores the counts, never the names looked up.
Is it working?
Section titled “Is it working?”The status line shows one of four states:
- Off: nothing is installed.
- Configured but unverified: the configuration is installed, or waiting for your approval in System Settings, and Outbound hasn’t seen it in use yet.
- Encrypted (verified): during a test, the filter saw macOS’s resolver connect to your chosen server.
- Partly bypassed (N apps): some apps went around the setting.
A test asks for the name’s IPv4 (A) and IPv6 (AAAA) addresses, once through macOS and once directly from your resolver, over HTTPS or TLS. A successful answer alone doesn’t prove encryption: only the filter seeing the encrypted connection does.
Providers
Section titled “Providers”Choose from a catalogue of encrypted DNS providers. Global lists Quad9 (the default), Cloudflare, Google Public DNS, NextDNS and Control D Unfiltered; Regional lists DNS4EU Protective. You can also enter your own with Custom….
The selected provider’s details show its operator, legal jurisdiction, filtering, logging-policy summary and privacy-policy link. Jurisdiction is legal domicile, not server location.
Choose DNS over HTTPS or DNS over TLS. Applying the choice supplies the provider’s endpoint and, where listed, bootstrap server addresses for that protocol. NextDNS also needs your Profile ID. See DNS settings for the fields, or use outboundctl dns providers to read the catalogue from Terminal.
Exceptions, profiles and sign-in pages
Section titled “Exceptions, profiles and sign-in pages”An exception sends a domain and all its subdomains to the network’s own DNS server. It can apply in every profile or only the ones you choose, carry a note, and end by itself after 15 minutes. You can also turn encryption off entirely in chosen profiles, for a network where it gets in the way.
On a hotel or airport network whose sign-in page won’t load, Pause for Captive Portal (15 Min) turns encryption off for 15 minutes. It isn’t the same as pausing Outbound: your rules stay in force.
macOS DNS settings can’t send one name to a different resolver, or match a name exactly without its subdomains, so Outbound offers neither.
Blocking plaintext DNS
Section titled “Blocking plaintext DNS”Block plaintext DNS from apps while encryption is on is off by default. On, it blocks apps that send unencrypted DNS on port 53 themselves. macOS’s own resolver is exempt, so exceptions and sign-in pages keep working. To block one app only, use Block Plaintext DNS for This App on its row under Not covered; that adds a priority rule you can see in Rules.
The full page is described in DNS settings.