Privacy technology
DNS privacy on macOS
Every website you visit begins with a DNS lookup — your Mac asking "what is the address for this name". By default that question travels in plain text, which means the network you are on, and your ISP, can read and log every domain you reach for. In 2026 there is no good reason to leave it that way.
Why plain DNS is a problem
A plain lookup on port 53 is visible to everyone between you and the resolver. It reveals which sites and services you use even when the connections themselves are encrypted, and on a hostile network it can be tampered with to redirect you.
The two things to fix
Encrypt the transport. DNS over HTTPS (DoH) and DNS over TLS (DoT) wrap the query so the local network and ISP see only ciphertext. macOS supports both natively through a configuration profile — no application required.
Filter the answers. A filtering resolver refuses to resolve known tracker, advertising and malware domains, so those connections are never attempted. This is the highest return for the lowest effort of anything in Mac privacy.
Setting it up
Choose a reputable resolver that offers both encryption and filtering, install its configuration profile once, and confirm in System Settings → Network → DNS that the encrypted resolver is active. From that point it applies to every application on the machine with no ongoing decisions.
Very aggressive filtering lists break sites in ways that are hard to diagnose — a login that silently fails, an image that will not load. Start with a moderate list and tighten only if you are willing to troubleshoot the occasional breakage.
Where it fits
DNS filtering pairs naturally with outbound monitoring: the resolver handles bulk blocking with zero effort, and a firewall provides per-application attribution for what remains. Both are part of the workstation setup, and doing DNS first makes the firewall's first week far quieter, as explained in the alert fatigue guide.