MacDNS v2.0.0

What's New

A Completely New DNS Engine

MacDNS 2.0 replaces Unbound with a brand-new DNS resolver built directly into the app. Everything now runs inside MacDNS itself instead of a separate background program, which means faster startup, lower memory use, and no more helper processes to manage. Every DNS feature you already relied on carried over, and many now behave more correctly than before.

Choose Your Encrypted DNS Providers

You can now decide exactly which encrypted DNS providers MacDNS uses and how it talks to them, from both the Settings window and the menu bar.

• Turn Cloudflare, Google and Quad9 on or off individually
• Pick how queries are sent: Parallel, Staggered or Sequential
• Toggle Answer Refinement, which cross-checks answers between providers for extra confidence

Faster Repeat Lookups

The DNS cache now survives restarts, so the first minutes after a reboot or an update feel as fast as a machine that has been running all day. Popular names are refreshed in the background before they expire, and if every provider is temporarily unreachable, MacDNS serves the last known good answer instead of failing the lookup.

Honest Protection Status

The menu bar now shows protection as active only when DNS traffic is genuinely being intercepted and filtered, never as an optimistic guess. If the app starts before the background service is ready, it shows a neutral "Waiting for Agent" state instead of a misleading off switch, and switches over automatically once the service responds.

Automatic Recovery After Updates

MacDNS now detects when an update left an outdated DNS component running and repairs itself without any action from you. When self-repair is not possible, a clear "Restart Required" notice appears and disappears on its own once the new version is actually in charge.

Better DNSSEC Behavior

DNSSEC records now always reach applications that ask for them, so tools like dig +dnssec and validating clients on your machine work as expected. MacDNS also stops claiming an answer was authenticated when it was not, and the DNSSEC setting now controls whether your provider rejects forged answers on your behalf.

More Local DNS Record Types

Local overrides accept far more record types than before, including SRV, CAA, HTTPS, SVCB, TLSA and SSHFP. Internal chat, VoIP and certificate-pinning setups can now be expressed directly, and modern macOS features that depend on HTTPS records are configurable too.

Split DNS and Private Network Routing

Private and internal names now stay private. Custom forward and stub zones, addresses handed out by your network, reverse lookups for private IP ranges and .onion names are all resolved locally and are never sent to public DNS providers, even when a background refresh happens with no app involved.

DNS Rebinding Protection

Public DNS answers that point at addresses on your local network are now stripped before they reach applications, which blocks a common class of attack against devices and services behind your router. Your own custom zones and overrides are exempt, so intentional private addresses keep working.

Improvements

Blocklist Reliability

• Restored updates for the HaGeZi threat intelligence list after the upstream source was retired
• Existing protection is kept in place if a downloaded list turns out to be empty or broken
• International and internationalized domain names are now matched correctly
• Categories can be changed while protection is off, and the choice is applied when you turn it back on
• Updating a list no longer clears the DNS cache, so browsing stays fast during refreshes

Network Changes, VPNs and Captive Portals

MacDNS now recovers much more reliably when you switch networks, connect a VPN, wake from sleep or sign in through a hotel or airport portal. Stale connections are rebuilt instead of lingering, and the app no longer gets stuck reporting a captive portal after you have already signed in.

Correctness of DNS Answers

A long list of protocol-level defects were fixed, including truncated responses, mismatched replies, incorrect negative answers and cases where one failing domain could make unrelated domains stop resolving. Responses now follow the DNS standards much more closely, which improves compatibility with browsers, VPN clients and developer tools.

Stability and Resource Use

• The DNS components now limit how many connections they hold, so a burst of traffic cannot exhaust system resources
• Crashes in the DNS engine are recorded with enough detail to be diagnosed
• Quitting, disabling and re-enabling protection are safer and no longer leave the app in a half-configured state
• Worker threads now scale to your Mac instead of using a fixed number

Security Hardening

Communication between the app, the background service and the DNS components is now mutually authenticated, and protection fails closed rather than silently letting traffic through if that verification breaks. License checks are cryptographically verified and cannot be extended by changing the system clock.

Interface Refinements

• The Settings window is taller so every option in the General tab is visible
• Provider and dispatch menus use native macOS controls with correct checkmarks
• The DoH/DoT setting now states exactly what it blocks: DoT and known DoH providers
• The About tab reports the built-in DNS engine version and now reads "Powered by MacDNS"

Quieter, More Useful Logs

Routine operations no longer flood the system log, while genuine failures now carry the detail needed to explain what went wrong. Query and reply logging remains opt-in and off by default.

MacDNS v1.1.22

Improvements

More Reliable Service Start and Stop

Fixed several issues where rapidly toggling DNS protection could leave services in an inconsistent state. Starting and stopping are now fully synchronized, ensuring protection is always cleanly enabled or disabled without getting stuck.

Better Blocklist Update Error Reporting

When blocklist downloads fail, MacDNS now properly reports the error instead of silently treating it as up-to-date. You will see clear feedback when updates cannot be completed.

Improved Extension Update Detection

macOS now reliably detects and installs updated system extensions on every app update, even for minor changes. Previously, some updates could be skipped if the version number had not changed.

Comprehensive Stability and Security Fixes

A thorough review resulted in over 30 fixes across the application:

• DNS queries now have a timeout to prevent stalled lookups
• Improved handling of encrypted DNS bypass attempts over UDP
• Captive portal recovery is now more reliable
• Memory usage is better controlled under heavy DNS activity
• Dependency downloads are verified with checksums for integrity

MacDNS v1.1.21

Improvements

Updated Dependencies

• Updated Expat XML parsing library to version 2.7.4, bringing the latest
  security patches and stability fixes.

MacDNS v1.1.20

Improvements

Security Update

Updated OpenSSL to version 3.6.1, which includes the latest security patches and stability improvements.

MacDNS v1.1.19

What's New

Block External DNS-over-HTTPS and DNS-over-TLS

MacDNS can now block applications from bypassing your local DNS resolver by using encrypted DNS protocols. When enabled, this feature blocks DNS-over-TLS (DoT) connections and DNS-over-HTTPS (DoH) requests to major providers like Google, Cloudflare, and Quad9. Enable this option in the General tab under "Block external DoH & DoT".

Quick Settings from Menu Bar

Access your most common settings directly from the menu bar. Hover over the new Configuration menu item to see a popover with quick toggles for DNSSEC, logging, prefetch, and other options without opening the full settings window.

Improved License Expiration Notifications

License expiration notifications are now scheduled at specific times: 24 hours, 12 hours, and 2 hours before expiration, plus at the moment of expiration. This ensures you receive timely reminders regardless of when the app is open.

Priority Update Notifications

Update notifications now use time-sensitive delivery to ensure you see important security and feature updates even when Focus or Do Not Disturb modes are enabled.

Improvements

Better DNS Interception

• DNS protection now intercepts queries from all network sources, including manually configured DNS servers
• Previously, only automatically assigned DNS servers (via DHCP or VPN) were intercepted

Improved Stability and Reliability

• Fixed an issue where the status could incorrectly show "Starting..." when disabling protection
• Resolved rare timeout issues that could occur during high DNS activity
• Fixed allowlisted domains sometimes returning stale blocked responses after restart
• Improved cache restoration to prevent validation failures from previous sessions

Reduced Memory Usage

Cache operations now use streaming instead of loading the entire cache into memory. This reduces memory usage by over 99% during cache save and restore operations, improving stability on systems with limited resources.

Better Domain Compatibility

Improved compatibility with certain domains that previously failed to resolve due to strict referral validation.

UI Improvements

• Settings window tips section is now properly centered
• Minor layout adjustments for better visual consistency

VirusTotal Scan Results

MacDNS.dmg - ✅ Clean (61 engines, 0 detections)

MacDNS v1.1.18

What's New

Flexible App and Agent Lifecycle

MacDNS now offers more control over how the app and background agent behave. You can choose to quit just the menu bar app while keeping DNS protection running in the background, or quit both together. Disabling DNS protection no longer removes the agent, making re-enabling faster and more seamless.

• Quit MacDNS (⌘Q): Closes the menu bar app while the agent continues running
• Quit MacDNS & Agent (⌘⇧Q): Stops everything completely
• Toggling DNS protection OFF now keeps the agent idle for quick re-enable

Improvements

Enhanced Stability During Network Changes

Fixed a rare issue where DNS protection could become unresponsive during network configuration changes, particularly when license validation occurred. The system now handles concurrent operations more reliably.

Faster Startup

Reduced redundant operations during app and agent initialization, resulting in quicker startup times and cleaner logs.

VirusTotal Scan Results

MacDNS.dmg - ✅ Clean (61 engines, 1 false machine learning detection)

v1.1.17

What's New

High-Performance DNS Proxying

MacDNS now uses an optimized socket-based connection pool for DNS queries, eliminating per-query connection overhead. DNS responses are now faster and more efficient, especially under heavy query loads.

Smarter Cache Management

When you modify custom zones, overrides, or allowlists, MacDNS now flushes only the affected domains from the cache instead of clearing everything. Your DNS queries stay fast while changes take effect immediately.

Improvements

Enhanced Reliability

• Improved connection handling between the app and background agent with better timeout management
• Prevents unnecessary restarts when the DNS proxy is already in the desired state
• Streamlined cleanup process to prevent orphaned configurations

Better Extension Management

• Automatic detection and handling of extension approval states
• More reliable extension status monitoring and updates

VirusTotal Scan Results

MacDNS.dmg - ✅ Clean (61 engines, 0 detections)

MacDNS v1.1.16

What's New

Wildcard DNS Overrides

You can now create wildcard DNS overrides that apply to an entire domain and all its subdomains. Simply prefix your domain with *. (e.g., *.example.com) to redirect all subdomains to a specific IP address. This is perfect for development environments or blocking entire domain families.

Local Root Zone Resolution

MacDNS now resolves the DNS root zone locally using RFC 8806 standards. This provides faster initial DNS lookups and enhanced privacy by reducing queries to external root servers. The root zone is automatically downloaded and kept up-to-date in the background.

Comprehensive DNS Record Validation

The app now validates all DNS record values before saving:

• IPv4 and IPv6 addresses are strictly validated
• Record-type specific rules for A, AAAA, CNAME, MX, TXT, and more
• TXT records reject invalid characters and enforce length limits
• Wildcard conflicts are detected and prevented

Improvements

Enhanced Stability

Several improvements make MacDNS more reliable and crash-resistant:

• Fixed a potential freeze that could occur during startup when validating your license
• Improved graceful shutdown behavior when quitting the app or restarting your Mac
• Added timeouts to prevent the app from hanging if the background service is unresponsive
• Better error recovery when downloading blocklists fails

Security Hardening

• DNS configuration values are now sanitized to prevent potential injection attacks
• Improved validation of all user-provided domain names and IP addresses

Faster DNS Cache Refresh

DNS records are now prefetched when 50% of their lifetime remains (previously 90%), ensuring frequently accessed domains stay fresh in cache and respond faster.

MacDNS v1.1.15

What's New

Automatic Update Check on Settings Open

MacDNS now automatically checks for updates when you open the Settings window. If a new version is available, you'll see the update dialog right away without needing to manually check.

Smarter Network Change Handling

When switching between networks (like moving from WiFi to cellular), MacDNS now handles the transition more gracefully. Multiple rapid network changes are consolidated to avoid unnecessary refreshes, resulting in smoother DNS resolution during network switches.

Improvements

Enhanced Allowlist Management

The allowlist now supports enabling and disabling individual domains without removing them. Your allowlist settings are also more reliably preserved across app restarts.

Better Stability and Reliability

• Improved responsiveness when the system is under heavy load
• More reliable DNS cache restoration after system events
• Better handling of network monitoring to prevent potential crashes
• Cleaner component removal process with less notification noise

MacDNS v1.1.14

Release Notes

New Features

Blocked rule identification
When viewing blocklist statistics, you can now see which blocklist rule caused a domain to be blocked. For example, if www.example.com was blocked by the rule example.com, this information is shown in the tooltip. When adding a domain to the allowlist, the system now automatically uses the correct rule, making it easier to unblock domains.

More intuitive interface
In DNS Overrides settings, you can now click anywhere on the row to enable or disable a rule, not just on the toggle.

Bug Fixes

Improved uninstall stability
Fixed an issue where agent uninstallation could fail if the DNS service was still in the process of stopping.

Category label cleanup
Removed redundant warning from the "Malware & Security" blocklist category.

Security

Enhanced connection validation
Improved security validation for connections between the app and agent, using a more robust process identification method.