Create a Device Level macOS Encrypted DNS Policy

Many Apple devices support using an encrypted transport protocol to communicate with a Domain Name System (DNS). JumpCloud supports using DNS over HTTPS and DNS over Transport Layer Security (TLS) services. DNS encrypts traffic and hides DNS queries from view.

JumpCloud provides four policies to control encrypted DNS settings for macOS devices. You’ll configure DNS servers to control the queries that can use DNS on the device by supplying Supplemental Match Domains, Server Addresses, and Server URLs or names.

Prerequisites

• Apple Mobile Device Management (MDM) must be configured for your organization and Mac computers must be enrolled in JumpCloud MDM. See Set up Apple MDM. 
• Encrypted DNS over HTTPS:
  • The target macOS devices must be running on macOS Big Sur and later.
• Encrypted DNS over TLS:
  • The target macOS devices must be running on macOS Big Sur and later.
• Devices must have an active network connection for this policy to take effect.

Considerations

• The policy configuration settings are applied automatically and do not require a system restart.

Creating the Encrypted DNS over HTTPS Policy

To create a Encrypted DNS over HTTPS policy for Mac computers, do the following:

Selecting the Policy Template

1. Log in to the JumpCloud Admin portal.

2. Go to Device Management > Policy Management. The Policy Management page is displayed.
3. On the Policy Management page, click +Add New.
4. Select Device Policy to assign the policy to devices and device groups. On the New Device Policy page:
   • Select the macOS tab.
   • Search and select the required policy and click Configure. The Details tab of the policy is displayed.
   • On the Details tab, configure the required policy configuration settings.
   • (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
   • (Optional) In the Policy Notes field, enter details such as creation date of the policy, and information on testing and deployment of the policy.

Configuring the Policy

• Under Settings > Server Addresses, click Add Server Addresses.
• If your DNS servers have an IPv4 or IPv6 address, enter the address here. To add additional addresses, click Add Server Addresses. For example, 45.90.28.193.
• For Server URL, enter the server’s URI template. For example, https://dns.example.net/dns-query{?dns}.
• For Supplemental Match Domains, click Add Supplemental Match Domains.
• Enter a list of domain strings used to determine which DNS queries can use the DNS server. For example, dns.example.net. If you don’t provide this, all domains will use the DNS server. A single wildcard * prefix is supported, but not required.

Applying the Policy

• (Optional) Select the Policy Groups tab. Select one or more policy groups where you want to add this policy. 
• Select the Device Groups tab. Select one or more device groups where you want to apply this policy. For device groups with multiple OS member types, the policy only applies when a user logs into a supported Mac computer that is enrolled in Apple MDM.
• Or, select the Devices tab. Select one or more devices whom you want to add this policy to.
• Click Create Policy. A success message is displayed indicating the completion of policy creation.

Viewing Policy Status

1. Select the Status tab.
2. To see the last Result Log for a device where this policy is applied, click view.

Create the Encrypted DNS over TLS policy 

To create a Encrypted DNS over TLS policy for Mac computers, do the following:

Selecting the Policy Template

1. Log in to the JumpCloud Admin portal.

2. Go to Device Management > Policy Management. The Policy Management page is displayed.
3. On the Policy Management page, click +Add New.
4. Select Device Policy to assign the policy to devices and device groups. On the New Device Policy page:
   • Select the macOS tab.
   • Search and select the required policy and click Configure. The Details tab of the policy is displayed.
   • On the Details tab, configure the required policy configuration settings.
   • (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
   • (Optional) In the Policy Notes field, enter details such as creation date of the policy, and information on testing and deployment of the policy.

Configuring the Policy

• For Server Addresses, click Add Server Addresses.
• If your DNS servers have an IPv4 or IPv6 address, enter all the addresses here. To add additional addresses, click Add Server Addresses. For example, 45.90.28.193. 
• For Server Name, enter the server’s hostname of a DNS over TLS server. If there are multiple existing server names, click in the field to see those names. The hostname is used to validate the server certificate. 
• For Supplemental Match Domains, click Add Supplemental Match Domains.
• Enter a list of domain strings used to determine which DNS queries can use the DNS server. For example, dns.example.net. If you don’t provide this, all domains will use the DNS server. A single wildcard * prefix is supported, but not required.

Applying the Policy

• (Optional) Select the Policy Groups tab. Select one or more policy groups where you want to add this policy. 
• Select the Device Groups tab. Select one or more device groups where you want to apply this policy. For device groups with multiple OS member types, the policy only applies when a user logs into a supported Mac computer that is enrolled in Apple MDM.
• Or, select the Devices tab. Select one or more devices whom you want to add this policy to.
• Click Create Policy. A success message is displayed indicating the completion of policy creation.

Viewing Policy Status

1. Select the Status tab.
2. To see the last Result Log for a device where this policy is applied, click view.