How can I enable DoH or DoT (DNS over HTTPS or TLS) in Safari

Question

How can I enable DoH or DoT (DNS over HTTPS or TLS) in Safari / how can I reach sites my ISP is blocking at the DNS level if they're also blocking iCloud Private Relay.

I'm trying to reach some websites (with health information) that are being blocked. I think it's due to Comcast Business' "Security Edge" hijacking my DNS traffic. When I check my DNS traffic, I see that the DNS traffic is hijacked - I get the IP of pxy.prd.live.c2szps.spscld.net when I ask for the IP of certain sites instead of the real IPs.

Answer 1

Safari itself doesn't support DoH or DoT, however the OS does, via Profiles.

What worked for me was to install one of the Quad9 profiles I found at

https://docs.quad9.net/Setup_Guides/MacOS/Big_Sur_and_later_%28Encrypted%29/#choosing-dns-over-tls-or-dns-over-https (I installed the (DNSSEC, Threat-Blocking, with ECS, DNS over TLS) one.

They are a temporary fix - as documented there, "These profiles are only valid until they expire, at which point, they will automatically disable until a new profile is installed. This is by design of Apple, and there is no way around it."

Also, this only fixed some sites. Others are blocked by hijacked HTTPS traffic.

As far as I can tell, the UI to set this up from scratch is not available in System Settings. I guess Apple is trying to keep things locked down to improve overall security - which, come to think of it, makes sense, IMO, now that I think about it.

Answer 2

Four ways to avoid DNS "censorship" by your ISP:

1. Use a VPN service (I use PIA, but others are equally good) which can be configured to use the VPN server as DNS provider.

2. Use AdGuard for Mac which provides access to DNS servers (AdGuards's, Cloudflare, Quad9, etc.) using DoH.

3. Run AdGuard Home on your Mac - it is a configurable DNS resolver.

4. Run your own DNS resolver on a Raspberry Pi - e.g. Pi-hole or AdGuard Home

I am sure there are more.