Encrypted DNS and DNS proxy: manage them with MDM on Apple OS 27
Apple documents two complementary declarative configurations for OS 27: one sends queries to an encrypted DNS-over-HTTPS or DNS-over-TLS resolver; the other hands them to a DNS proxy app extension. For network, security and MDM teams, this provides a way to align off-site protection, split DNS, filtering and managed apps without treating these mechanisms as interchangeable.
1. What Apple adds to declarative management
The DNS settings configuration applies to iOS 27, iPadOS 27, Shared iPad, macOS 27 and visionOS 27. It defines an encrypted HTTPS or TLS resolver, optional server addresses, matching domains and on-demand rules based on the network. Apple also provides an option that prevents users from disabling the configuration.
The DNS proxy configuration, available across the same OS 27 families, routes requests to an app extension identified by its bundle ID. Under User Enrollment on iPhone, iPad or Vision Pro, a UUID links the DNS proxy to the relevant managed apps. Actual availability still depends on each MDM vendor’s implementation.
2. An encrypted resolver and DNS proxy solve different problems
Encrypted DNS protects query transport to the selected resolver. Supplemental match domains enable split DNS, while on-demand rules adapt behaviour to an SSID, interface or domain. Allowing fallback to the system resolver must be a deliberate choice: it may improve continuity, but it can also bypass the intended control.
A DNS proxy adds logic delivered by an app and its network extension, for example to enforce vendor-specific filtering or inspection. Teams therefore need to govern the app, extension, bundle ID, vendor settings and update lifecycle together. This topic complements our Apple enterprise network access guide and our TLS and ATS guide for MDM.
3. What does this change for a Belgian or French organization?
For an SMB, managed encrypted DNS can extend a security policy beyond the office without requiring a full VPN tunnel. For a mid-market or large enterprise operating across Belgium, France and other European sites, on-demand rules and supplemental domains help maintain a consistent architecture across internet access, internal resources and remote work.
Public bodies and regulated sectors should document who operates the resolver, the purpose of filtering, which logs are collected, how long they are retained and whether any transfers occur. Encrypting DNS transport does not hide processing from the resolver, so compliance and proportionality still need validation with security and data-protection teams.
4. Underside analysis: govern a chain, not an isolated payload
Our view is that the MDM configuration is only the starting point. An operational policy connects Apple Business Manager, Automated Device Enrollment, Jamf or another MDM, certificates, the security app, resolver, proxy, Wi-Fi, VPN and network monitoring. It also defines what happens when the DNS service is unavailable.
The pilot must cover office, home, tethering, guest networks and VPN tunnels. It should verify public and internal resolution, leak prevention, fallback behaviour, configuration removal and critical-app continuity. A setting being accepted by the device does not prove that the actual DNS path is the intended one.
5. Recommended qualification plan
- Choose native encrypted DNS, an app-based DNS proxy or a combination justified by the architecture.
- Verify exact OS 27 declaration support in Jamf or the selected device-management service.
- Document DoH or DoT, certificates, supplemental domains, on-demand rules and fallback policy.
- For a proxy, validate the bundle ID, provider identifier, vendor configuration and managed-app association.
- Test multiple networks, VPN, captive portals, resolver failure and configuration removal.
- Correlate results on the device, in MDM, at the resolver and in network tools before broad deployment.
Goal: maintain an encrypted, observable and resilient DNS path suited to devices and apps, without introducing silent outages or security bypasses.
Audit your Apple network architectureOfficial Apple sources: DNS settings declarative configuration for Apple devices and DNS proxy declarative configuration for Apple devices, published September 17, 2026.