Need for system-wide profile

[csousougen]

In Mac, Safari uses the encrypted dns, all other apps like terminal and App Store use the unencrypted dns server from network settings.
Could you please create a profile that uses system-wide encrypted dns?

[paulmillr]

How?

[csousougen]

I’ve found these system-wide configurations but i don’t know how to import into a mobileconfig

https://www.wwdcnotes.com/notes/wwdc20/10047

@csousougen Actually an MDM profile is by default system wide...
During the developer conference of 2020 when they have announced this feature they have said :

"The first way is to use a single [encrypted] DNS server as the default resolver for all apps on the system. If you provide a public [encrypted] DNS server, you can now write a network extension app that configures the system to use your server. Or, if you use Mobile Device Management to configure enterprise settings on devices, you can push down a profile to configure encrypted DNS settings for your networks,"

The code you have linked is for the dev who want to use encrypted dns for their app (or make an app to activate this dns (like adguard pro for iOS)).

@paulmillr Since it's not a bug in .mobileconfig file I ask this issue be closed.
We cannot fix it only apple can so I vote to close it but it's up to you.

[paulmillr]

@BirdInFire I won't close these and other issues that describe Apple bugs. We can't do anything but we can make bugs visible.

[csousougen]

I can say for sure that on Mac, it is not system wide. The DIG command gets results from the DNS servers that are set in Network and not from the MDM profile. If you try "dig google.com" you will see ;; SERVER: IP address in results.

I can say for sure that on Mac, it is not system wide. The DIG command gets results from the DNS servers that are set in Network and not from the MDM profile. If you try "dig google.com" you will see ;; SERVER: IP address in results.

i have tested it like 10 minutes ago with nextdns to see the log on DNSserver side and it's totally system wide

[csousougen]

@BirdInFire could you please try to put a fake dns (127.0.0.5) in network settings, press Apply and then check if DIG command works?
Also, I tried to dig astalavista.com from the cmd and it didn't show up in nextdns logs.
However, all queries that come from Safari are totally encrypted.

Will do a more profound testing to be sure

I have tested with a new account and done a ping on terminal on google.lol (who does not exist) after having installed their profile (used on apple.nextdns.io) and some second after the ping (who have failed since google.lol does not exist, it appeared on the logs, tried again with .jp and worked also).

Need more search but I really think it's system wide, maybe when you modify your dns (after) having installed the profile it override the profile.

[csousougen]

@BirdInFire You are correct, with ping command it works. But it does not work with DIG command and nslookup command.
Could you please try these commands too? Is it system wide if it does not work with any command?

Sure will do a complete test when I'm at home (actually I have done it remotely), but it's possible that some system component are exempted by this profile (network app).

@csousougen after some search I have found some profile who add :

<key>PayloadScope</key>
<string>System</string>

Can you add it to your profile and do your test (seem I can't replic the problem as well as you).
And see if it solve the problem ?

If it's the case I will do a PR on all profile to add it.

[csousougen]

Hi @BirdInFire
I added the 2 lines just above in nextdns profile. Still, dig and nslookup commands do not go through the encrypted dns (no logs in nextdns).
However, I see in the logs, queries from all apps that run on my mac, this tells that the profile is system wide, except for these two commands (dig and nslookup).

[paulmillr]

Added BirdInFire's stuff to readme.