Set up dnsdome on macOS

Plain DNS in System Settings

Good for a desktop Mac that never leaves the network. The Mac is identified by the network's public IP, which must be on your profile's allowlist.

1. In the panel, add your network's public IP to the profile's allowlist.
2. Open System Settings → Network, select your active connection and click Details… (on macOS 12 and older, Advanced…).
3. Open the DNS tab, remove the existing servers with the minus button, add 87.244.198.165 and click OK.
4. Flush the cache and test in Terminal:

   sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
   dig doubleclick.net @87.244.198.165 +short

Encrypted DNS with a configuration profile (macOS 11+)

Since Big Sur, macOS accepts the same DNS Settings payload as iOS. A profile with a DNS-over-TLS or DNS-over-HTTPS server applies to every app on the Mac and keeps working on any network, because the token in the hostname identifies your dnsdome profile.

1. Open your profile's Encrypted DNS card in the panel and copy the DoT hostname <token>.dns.dnsdome.com or the DoH URL https://dns.dnsdome.com/dns-query/<token>.
2. Get a .mobileconfig: open a ticket from the panel's Help page and we send a signed one for your profile, or build your own in Apple Configurator with a DNS Settings payload (protocol TLS or HTTPS, server name or URL as above, server address 87.244.198.165).
3. Double-click the file, then go to System Settings → Privacy & Security → Profiles and click Install.
4. Check the log in the panel: queries from the Mac appear within a minute, tagged with the profile or device the token belongs to.

A DNS profile is not a VPN. It changes only where the system resolver sends queries and adds no background process.

Good to know

• Safari has no in-browser DoH setting, so the profile is the only way to cover it with encrypted DNS. Firefox and Chrome can be pointed at dnsdome individually; see browsers.
• iCloud Private Relay resolves Safari's DNS through Apple. Turn it off for filtering to apply in Safari.
• A connected VPN with its own DNS takes precedence over both methods above.