What's New
A Completely New DNS Engine
MacDNS 2.0 replaces Unbound with a brand-new DNS resolver built directly into the app. Everything now runs inside MacDNS itself instead of a separate background program, which means faster startup, lower memory use, and no more helper processes to manage. Every DNS feature you already relied on carried over, and many now behave more correctly than before.
Choose Your Encrypted DNS Providers
You can now decide exactly which encrypted DNS providers MacDNS uses and how it talks to them, from both the Settings window and the menu bar.
- Turn Cloudflare, Google and Quad9 on or off individually
- Pick how queries are sent:
Parallel,StaggeredorSequential - Toggle
Answer Refinement, which cross-checks answers between providers for extra confidence
Faster Repeat Lookups
The DNS cache now survives restarts, so the first minutes after a reboot or an update feel as fast as a machine that has been running all day. Popular names are refreshed in the background before they expire, and if every provider is temporarily unreachable, MacDNS serves the last known good answer instead of failing the lookup.
Honest Protection Status
The menu bar now shows protection as active only when DNS traffic is genuinely being intercepted and filtered, never as an optimistic guess. If the app starts before the background service is ready, it shows a neutral "Waiting for Agent" state instead of a misleading off switch, and switches over automatically once the service responds.
Automatic Recovery After Updates
MacDNS now detects when an update left an outdated DNS component running and repairs itself without any action from you. When self-repair is not possible, a clear "Restart Required" notice appears and disappears on its own once the new version is actually in charge.
Better DNSSEC Behavior
DNSSEC records now always reach applications that ask for them, so tools like dig +dnssec and validating clients on your machine work as expected. MacDNS also stops claiming an answer was authenticated when it was not, and the DNSSEC setting now controls whether your provider rejects forged answers on your behalf.
More Local DNS Record Types
Local overrides accept far more record types than before, including SRV, CAA, HTTPS, SVCB, TLSA and SSHFP. Internal chat, VoIP and certificate-pinning setups can now be expressed directly, and modern macOS features that depend on HTTPS records are configurable too.
Split DNS and Private Network Routing
Private and internal names now stay private. Custom forward and stub zones, addresses handed out by your network, reverse lookups for private IP ranges and .onion names are all resolved locally and are never sent to public DNS providers, even when a background refresh happens with no app involved.
DNS Rebinding Protection
Public DNS answers that point at addresses on your local network are now stripped before they reach applications, which blocks a common class of attack against devices and services behind your router. Your own custom zones and overrides are exempt, so intentional private addresses keep working.
Improvements
Blocklist Reliability
- Restored updates for the HaGeZi threat intelligence list after the upstream source was retired
- Existing protection is kept in place if a downloaded list turns out to be empty or broken
- International and internationalized domain names are now matched correctly
- Categories can be changed while protection is off, and the choice is applied when you turn it back on
- Updating a list no longer clears the DNS cache, so browsing stays fast during refreshes
Network Changes, VPNs and Captive Portals
MacDNS now recovers much more reliably when you switch networks, connect a VPN, wake from sleep or sign in through a hotel or airport portal. Stale connections are rebuilt instead of lingering, and the app no longer gets stuck reporting a captive portal after you have already signed in.
Correctness of DNS Answers
A long list of protocol-level defects were fixed, including truncated responses, mismatched replies, incorrect negative answers and cases where one failing domain could make unrelated domains stop resolving. Responses now follow the DNS standards much more closely, which improves compatibility with browsers, VPN clients and developer tools.
Stability and Resource Use
- The DNS components now limit how many connections they hold, so a burst of traffic cannot exhaust system resources
- Crashes in the DNS engine are recorded with enough detail to be diagnosed
- Quitting, disabling and re-enabling protection are safer and no longer leave the app in a half-configured state
- Worker threads now scale to your Mac instead of using a fixed number
Security Hardening
Communication between the app, the background service and the DNS components is now mutually authenticated, and protection fails closed rather than silently letting traffic through if that verification breaks. License checks are cryptographically verified and cannot be extended by changing the system clock.
Interface Refinements
- The Settings window is taller so every option in the General tab is visible
- Provider and dispatch menus use native macOS controls with correct checkmarks
- The DoH/DoT setting now states exactly what it blocks: DoT and known DoH providers
- The About tab reports the built-in DNS engine version and now reads "Powered by MacDNS"
Quieter, More Useful Logs
Routine operations no longer flood the system log, while genuine failures now carry the detail needed to explain what went wrong. Query and reply logging remains opt-in and off by default.