DNS Settings

com.apple.dnsSettings.managed

The payload that configures encrypted DNS settings.

iOS 14.0+ · deprecated 27.0macOS 11.0+ · deprecated 27.0visionOS 1.0+ · deprecated 27.0

Not available with User Enrollment · macOS: device channel only

Configuration Keys (3)

Key	Type	Description	Default	Range
`DNSSettings`dict DNS settings required	dict	A dictionary that defines a configuration for an encrypted DNS server.	Default: —	Range: —
`DNSProtocol`string DNS protocol	string	The encrypted transport protocol used to communicate with the DNS server.	Default: —	Range: HTTPS, TLS
`ServerAddresses`array DNS server addresses	array	An unordered list of DNS server IP address strings. These IP addresses can be a mixture of IPv4 and IPv6 addresses.	Default: —	Range: —
`ServerAddressesElement`string Server address element	string	—	Default: —	Range: —
`ServerName`string Server name	string	The hostname of a DNS-over-TLS server used to validate the server certificate, as defined in RFC 7858. If no 'ServerAddresses' are provided, the system uses the hostname to determine the server addresses. This key must be present only if the DNSProtocol is 'TLS'. Depends on: DNSSettings.DNSProtocol ∈ [TLS]	Default: —	Range: —
`ServerURL`string Server URL	string	The URI template of a DNS-over-HTTPS server, as defined in RFC 8484. This URL needs to use the 'https://' scheme, and the system uses the hostname or address in the URL to validate the server certificate. If no 'ServerAddresses' are provided, the system uses the hostname or address in the URL to determine the server addresses. Required if 'DNSProtocol' is 'HTTPS'. Depends on: DNSSettings.DNSProtocol ∈ [HTTPS]	Default: —	Range: —
`SupplementalMatchDomains`array Supplemental match domains	array	A list of domain strings used to determine which DNS queries use the DNS server. If not set, all domains use the DNS server. The system supports a single wildcard ('\') prefix, but it's not required. For example, both '\.example.com' and 'example.com' match against 'mydomain.example.com' and 'your.domain.example.com', but don't match against 'mydomain-example.com'.	Default: —	Range: —
`SupplementalMatchDomainsElement`string Supplemental match domains element	string	—	Default: —	Range: —
`AllowFailover`boolean Allow failover iOS 26.0+ · macOS 26.0+ · visionOS 26.0+	boolean	If 'true', the device allows failover to the default system DNS resolver.	Default: false	Range: —
`PayloadCertificateUUID`string Certificate UUID iOS 16.0+ · macOS 13.0+	string	The UUID that points to an identity certificate payload. The system uses this identity to authenticate the user to the DNS resolver.	Default: —	Range: —
`OnDemandRules`array On demand rules	array	An array of rules that define the DNS settings. If not set, the system always applies the DNS settings. These rules are identical to the 'OnDemandRules' array in VPN payloads.	Default: —	Range: —
`OnDemandRulesElement`dict On demand rules element	dict	—	Default: —	Range: —
`Action`string On demand action	string	The action to take if this dictionary matches the current network. Allowed values: 'Connect': Apply DNS Settings when the dictionary matches. 'Disconnect': Don't apply DNS Settings when the dictionary matches. 'EvaluateConnection': Apply DNS Settings with per-domain exceptions when the dictionary matches.	Default: —	Range: Connect (Connect), Disconnect (Disconnect), Evaluate Connection (EvaluateConnection)
`ActionParameters`array Action parameters	array	An array of dictionaries that provide per-connection rules. The system uses this array only for settings where the 'Action' value is 'EvaluateConnection'. Depends on: OnDemandRulesElement.Action ∈ [EvaluateConnection]	Default: —	Range: —
`ActionParameter`dict Action parameter	dict	A dictionary that provides per-connection rules. The keys allowed in each dictionary are described below. Note: This array is only for dictionaries in which 'EvaluateConnection' is the 'Action' value.	Default: —	Range: —
`DomainAction`string Domain action required	string	The DNS settings behavior for the specified domains. Allowed values: 'NeverConnect': Don't use the DNS Settings for the specified domains. 'ConnectIfNeeded': Allow using the DNS Settings for the specified domains.	Default: —	Range: Never Connect (NeverConnect), Connect if Needed (ConnectIfNeeded)
`Domains`array Domains required	array	The domains for which this evaluation applies.	Default: —	Range: —
`DomainsElement`string Domains element	string	—	Default: —	Range: —
`DNSDomainMatch`array DNS domain match	array	An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list. The system supports a single wildcard ('\') prefix, but it's not required. For example, both '\.example.com' and 'example.com' match against 'mydomain.example.com' and 'your.domain.example.com', but don't match against 'mydomain-example.com'.	Default: —	Range: —
`DNSDomainMatchElement`string DNS domain match element	string	—	Default: —	Range: —
`DNSServerAddressMatch`array DNS server address match	array	An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array. The system supports matching with a single wildcard. For example, '17.\*' matches any DNS server in the 17.0.0.0/8 subnet.	Default: —	Range: —
`DNSServerAddressMatchElement`string DNS server address match element	string	—	Default: —	Range: —
`InterfaceTypeMatch`string Interface type match	string	An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.	Default: —	Range: Ethernet, WiFi, Cellular
`SSIDMatch`array SSID match	array	An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails. Omit this key and the corresponding array to match against any SSID.	Default: —	Range: —
`SSIDMatchElement`string SSID match element	string	—	Default: —	Range: —
`URLStringProbe`string URL string probe	string	A URL to probe. This rule matches if this URL is successfully fetched and returns a 200 HTTP status code without redirection.	Default: —	Range: —
`ProhibitDisablement`boolean Prohibit disablement iOS · macOS · visionOS	boolean	If 'true', the system prohibits users from disabling DNS settings. This key is only available on supervised devices.	Default: false	Range: —