{"id":44944,"date":"2024-09-17T16:17:41","date_gmt":"2024-09-17T20:17:41","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=44944"},"modified":"2024-11-13T15:53:01","modified_gmt":"2024-11-13T20:53:01","slug":"little-snitch-6-and-dns-encryption","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2024\/09\/17\/little-snitch-6-and-dns-encryption\/","title":{"rendered":"Little Snitch 6 and DNS Encryption"},"content":{"rendered":"

Norbert Heger<\/a>:<\/p>\n

\n

Little Snitch 6 offers a new feature: DNS encryption. With DNS encryption enabled, all name lookups are routed through Little Snitch and performed in encrypted form.<\/p>\n

For this purpose, Little Snitch registers a DNS proxy. macOS then sends all<\/strong> DNS requests to that proxy, which in turn performs the lookup in encrypted form. The key point here is that all<\/strong> requests must be routed through the proxy.<\/p>\n

[…]<\/p>\n

There appears to be a bug in macOS Sequoia causing some<\/strong> requests to bypass the installed DNS proxy and be sent unencrypted to the system’s default name server instead.<\/p>\n

[…]<\/p>\n

After further investigation, we found that this bug has already existed at least since macOS 14.5 Sonoma (maybe even earlier, but we currently don’t have access to an older 14.x system for testing).<\/p>\n<\/blockquote>\n\n

For more on the Little Snitch 6 upgrade, see the press release<\/a>, release notes<\/a>, MacRumors<\/a>, and TidBITS<\/a>.<\/p>\n\n

Previously:<\/p>\n