PSA: It looks like macOS 13.0 Ventura natively supports DNS over HTTPS (DoH) and DNS over TLS (DoT).
This seems to be a completely undocumented feature, but I was able to find some practical evidence (1/7) 🧵
This seems to be a completely undocumented feature, but I was able to find some practical evidence (1/7) 🧵
This is what Wireshark shows when I set my DNS servers to 1.1.1.1 and ping a domain whose name was not previously cached: (of course, I cannot view the actual traffic since it is encrypted; that's the point of DoH) (2/7) 
Sure enough, the source code of the latest version (1310) of mDNSResponder contains some interesting additions: (3/7)
And finally, mDNSResponder logs also give it away: (4/7)
Strangely enough, DoH does not seem to work if I set my own private DNS server (which, of course, supports DoH). This may be due to my CA being untrusted, although I have configured macOS to explicitly trust it (5/7)
macOS now also seems to prioritize servers supporting encrypted DNS vs. those only working with plain UDP. This is what broke my configuration in the first place, leading me to this discovery (?) (6/7)
I do wonder why this feature (which is quite an important improvement, if you ask me) was quietly slipped in the new macOS release with no mention or announcement whatsoever (7/7)
Appendix 1/2: mDNSResponder the system-wide DNS resolver on macOS, and it is open source: opensource.apple.com/tarballs/mDNSR…
Appendix 2/2: DNS over HTTPS (DoH) and DNS over TLS (DoT) are protocols for performing DNS resolution over an encrypted channel, increasing user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks
• • •
Missing some Tweet in this thread? You can try to
force a refresh
