How to Set Up FirewallDNS on macOS
By [FILL IN], [FILL IN] · Last updated
On a Mac you can set DNS servers per network service in System Settings, or install a configuration profile for encrypted DNS. This guide covers both approaches for macOS Ventura and later.
Requirements
- A FirewallDNS account with your public IP address registered in the dashboard
- Your FirewallDNS addresses, shown under [VERIFY: dashboard menu name where these values are shown]
- macOS Ventura (13) or later with an administrator account
- Optional: the FirewallDNS configuration profile for encrypted DNS
No account yet? See pricing.
Step by step
1.Open the Apple menu and choose System Settings, then select Network.
Image placeholder: screenshot of step 1 on macOS [VERIFY] 2.Select the service you use, such as Wi-Fi or Ethernet, then select Details next to the connected network.
Image placeholder: screenshot of step 2 on macOS [VERIFY] 3.Select DNS in the sidebar of the details window.
Image placeholder: screenshot of step 3 on macOS [VERIFY] 4.Under DNS Servers, select each existing entry and select the minus (−) button to remove it.
Image placeholder: screenshot of step 4 on macOS [VERIFY] 5.Select the plus (+) button and add [VERIFY: FirewallDNS primary DNS address], then add [VERIFY: FirewallDNS secondary DNS address]. Add [VERIFY: FirewallDNS IPv6 DNS addresses] if your network uses IPv6.
Image placeholder: screenshot of step 5 on macOS [VERIFY] 6.Select OK, then Apply if shown.
Image placeholder: screenshot of step 6 on macOS [VERIFY] 7.Optional, for encrypted DNS: download the profile from [VERIFY: configuration profile download link], open it, then go to System Settings > Privacy & Security > Profiles and install it.
Image placeholder: screenshot of step 7 on macOS [VERIFY] 8.Open Terminal and run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder.
Image placeholder: screenshot of step 8 on macOS [VERIFY]
How to verify it works
- In Terminal, run scutil --dns | grep nameserver and check that FirewallDNS addresses are listed first.
- Run nslookup example.com and check the Server line.
- Open the query log in your FirewallDNS dashboard and confirm that new lookups from your network appear within a few seconds.
How to revert
- Open System Settings > Network > your service > Details > DNS.
- Remove the FirewallDNS entries with the minus (−) button and select OK.
- If you installed a profile, remove it under Privacy & Security > Profiles.
Troubleshooting
- The DNS entries are greyed out
- They were assigned by DHCP. Add your own entries with the plus button; they take precedence.
- Lookups bypass FirewallDNS
- Check for VPN apps, iCloud Private Relay or a different profile that sets DNS.
- The profile will not install
- Profiles must be installed manually in System Settings after download; check that it is not blocked by device management.
FAQ
Does iCloud Private Relay affect DNS filtering?
Private Relay can handle DNS for Safari traffic. If filtering seems inconsistent in Safari, test with Private Relay turned off for that network.
Profile or manual DNS — which is better?
A profile can enable encrypted DNS that follows the Mac between networks. Manual DNS is simpler but unencrypted.
Do I need to set DNS for Wi-Fi and Ethernet separately?
Yes. Each network service has its own DNS list.
Is a FirewallDNS profile available?
[VERIFY: profile availability] When available it is downloaded from [VERIFY: configuration profile download link].
Will this work on older macOS versions?
The menus differ in older versions (System Preferences > Network > Advanced > DNS), but the idea is the same.