DNS settings
The DNS settings page: encrypted DNS through macOS's own DNS settings, its four status states, the plaintext DNS block, providers, scoped exceptions, the captive-portal pause, the test and the event log.
The DNS page turns on encrypted DNS using macOS’s own DNS settings. The line under the page title reads “Encrypts lookups made through macOS’s resolver.” Encrypting lookups hides which names this Mac looks up from the network it is on. On its own it doesn’t change what Outbound allows or blocks; the one setting here that blocks anything is Block plaintext DNS from apps. See DNS encryption.
Outbound isn’t a DNS proxy. It hands your choices to macOS, and macOS sends the lookups.
The page is disabled while Protect these settings is on and this session is locked. See Security.
Encrypt DNS lookups
Section titled “Encrypt DNS lookups”The main switch. Turning it on installs a DNS configuration in macOS with the provider, protocol and exceptions shown on the page. Turning it off removes the configuration and keeps your choices for next time.
macOS asks you once to approve the configuration. Until you do, the page reads “Waiting for approval in System Settings.” with an Open System Settings… button. On macOS 27 the switch is in Network › VPN & Filters; earlier versions list it under Network › Filters. If Outbound can’t open System Settings, the page names that path instead.
The status line under the switch is one of four states:
| Status | What it means |
|---|---|
| Off | No configuration is installed. Lookups use the network’s DNS server, unencrypted. |
| Configured but unverified | The configuration is installed, but Outbound hasn’t seen it in use yet. This is also the state while macOS waits for your approval. |
| Encrypted (verified) | During a test, the filter saw macOS’s resolver connect to your chosen server. |
| Partly bypassed (N apps) | Some apps sent DNS around the setting. They are listed under Not covered. |
While encryption is on, the line beneath reads: “On for apps that use macOS name lookup. Apps with their own resolvers, VPNs and DNS exceptions may bypass this setting.”
Pause for Captive Portal
Section titled “Pause for Captive Portal”While encryption is on, Pause for Captive Portal (15 Min) turns it off for 15 minutes, so the sign-in page of a hotel, airport or café network can load. Encryption comes back by itself when the time is up.
Not covered
Section titled “Not covered”This section shows DNS that went around the setting in the last 24 hours. The counts are connection attempts the filter saw, not individual DNS questions, and no query names are stored.
- Plaintext bypass attempts in 24 h: unencrypted DNS that apps sent straight to a server instead of through macOS.
- Blocked attempts in 24 h: how many plaintext DNS attempts Outbound blocked.
- Encrypted lookups: “Not counted with macOS DNS settings”.
Each app that bypassed the setting gets a row with its name and how many attempts it made to which server. An app that seems to run its own encrypted resolver is marked “Possible app-owned encrypted resolver; query contents are not visible.” When no app went around the setting, the section reads “No bypass observed in this filter session.”
Plaintext DNS
Section titled “Plaintext DNS”Block plaintext DNS from apps while encryption is on is off by default. When you turn it on, Outbound blocks apps that send unencrypted DNS (port 53) themselves while encryption is on. macOS’s own resolver is exempt, so exceptions and sign-in pages keep working, and it still follows your rules. A pause takes precedence: while Outbound is paused, this block isn’t enforced either.
To block one app instead, click Block Plaintext DNS for This App on its row. That adds a priority rule that blocks the app’s outgoing connections on port 53. You can see and remove the rule in Rules.
Server
Section titled “Server”Provider opens a catalogue grouped into Global and Regional choices:
- Global: Quad9, Cloudflare, Google Public DNS, NextDNS and Control D Unfiltered
- Regional: DNS4EU Protective
- Custom…, for a resolver of your own
Quad9 is selected until you change it.
For the selected provider, the page shows its operator, legal jurisdiction, filtering, logging-policy summary and a link to its privacy policy. Jurisdiction means legal domicile, not server location.
Protocol: DNS over HTTPS (the default) or DNS over TLS. A protocol the provider doesn’t offer can’t be chosen.
Applying a catalogue choice supplies its HTTPS URL or TLS server name and, where listed, bootstrap server addresses. Choosing a provider keeps your selected protocol. NextDNS uses your Profile ID to form its endpoint.
The fields that follow depend on the provider:
- NextDNS: a Profile ID field. It must be six hexadecimal characters; anything else is refused with “NextDNS needs a six-character hexadecimal profile ID.”
- Custom…: an HTTPS URL, a TLS server name and Server addresses (“Comma-separated IP addresses”). At least one address is required, each must be a valid IP address, and the URL must be an https address without credentials or a fragment (“Enter an HTTPS DNS endpoint without credentials or a fragment.”).
Apply Changes sends the server choices to macOS. It’s available when you’ve changed something. Turning the switch on uses the same choices.
When your organization sets the resolver through a configuration profile, the provider can’t be changed here. See Managed preferences.
Exceptions
Section titled “Exceptions”A domain on this list, and every subdomain of it, uses the network’s own DNS server instead of the encrypted one. Use it for company names that only resolve inside a network, or for a sign-in page. The footer reads: “Domains and their subdomains use this network’s unencrypted DNS. They are visible to the network.”
The list shows each exception’s Domain, Profiles and Note. Add one with the + button:
- Domain: the name. Every exception matches the domain and its subdomains.
- All Profiles: on by default. Turn it off to choose the profiles the exception applies to.
- Note: an optional reminder of why it’s there.
- Temporary for Captive Portal (15 Min): the exception ends by itself after 15 minutes.
Remove one by selecting it and clicking −.
Disable DNS Encryption in Profiles… turns encryption off entirely while one of the chosen profiles is active. The profiles you choose are listed under “Disabled in profiles”.
Changes to exceptions and profiles wait for Apply Exceptions.
“Test sends the domain to macOS and directly to your selected encrypted resolver, even when encryption is off.” Type a name in Domain, or leave it empty and Outbound makes up a random one. Click Test, which reads “Testing…” while it runs.
The results are in two sections, each with an IPv4 (A) and an IPv6 (AAAA) row:
- System resolver: what macOS answered, and whether the filter saw the lookup go to your server encrypted. That’s “Encrypted (observed)”, “Unexpectedly unencrypted” or “Answered from cache / not observed”.
- Direct encrypted server: what your chosen resolver answered when Outbound asked it directly, over HTTPS or TLS.
Each row shows the addresses returned, “No addresses”, or the error. After a test, a note reminds you that “A successful answer alone does not prove encryption.” A name that isn’t a valid ASCII domain (international names need punycode) is refused before any lookup runs.
Recent events
Section titled “Recent events”The section is titled “Recent Events”. It lists the last eight things the DNS configuration did, newest first, each with a timestamp: status changes, saves, removals, failures and tests. An empty log says “Nothing yet.” If Outbound can’t write the log, the page says so.
From Terminal
Section titled “From Terminal”outboundctl dns providers lists the catalogue; add --json for the full provider details. dns status shows the same status and 24-hour counts. dns test runs a lookup test, and dns exceptions list shows the exceptions in effect. dns configure, dns block-plaintext, dns exceptions add and remove, dns disable-profile and dns captive-portal request changes, which you approve in Outbound. See outboundctl dns.