In this article

DNSFilter transitioned the macOS Roaming Client from DNS interception via loopback (127.0.0.1) to an Apple NEDNSProxyProvider System Extension — the NetworkExtension framework's supported mechanism for DNS filtering on macOS. As Apple began phasing out unsupported interception methods in macOS 11 and beyond, this shift ensured continued compatibility, improved reliability, and long-term support across modern macOS environments.

The legacy approach: Loopback

The original Roaming Client (1.x) used a loopback interface to intercept and filter DNS traffic. This involved redirecting DNS requests to 127.0.0.1, where the agent inspected the traffic and enforced policies.

While effective for many years, this approach relied on undocumented and unsupported behaviors in macOS networking.

Apple began deprecating and restricting loopback interception methods starting with macOS 11 Big Sur, released in November 2020, introducing security controls that made this technique fragile and unreliable.

What happened

macOS 11 Big Sur introduced significant changes to system security and networking, including:

• Enhanced System Integrity Protection (SIP)
• Increased enforcement of signed and notarized system extensions
• Early limitations on legacy methods such as redirecting traffic to 127.0.0.1 (loopback)

These restrictions became stricter with each subsequent release:

• macOS 12 Monterey (2021): tightened enforcement of DNS resolution paths
• macOS 13 Ventura (2022): further reduced support for non-System Extension network interception, breaking loopback-based filtering under some conditions

While loopback may have appeared to work intermittently past Big Sur, Apple has established that the NetworkExtension and System Extension frameworks are the only supported methods going forward.

The Apple-compliant approach: System Extension

The updated agent runs as a System Extension using Apple's NEDNSProxyProvider API, part of the NetworkExtension framework, which intercepts and processes DNS queries at the OS level. This is the same framework used by enterprise security tools across the industry. DNS queries pass through this extension before reaching any resolver, giving DNSFilter accurate, reliable visibility into all DNS activity on the device.

This provides greater stability, better performance, and continued compatibility with current and future versions of macOS.

Why MDM profiles are required

Apple gates System Extensions behind explicit approval because they run in a privileged context with direct access to OS-level network flows. A silent install therefore relies on a set of configuration profiles delivered through MDM: one pre-approves the System Extension so macOS loads it without prompting the user, one tells macOS which extension to activate as the DNS proxy, and additional profiles supply the certificates the agent needs.

Without these profiles, macOS prompts the end user to approve the extension manually, and on macOS 15 and later that prompt appears in System Settings under General, then Login Items & Extensions. Deploying the profiles through MDM before the agent installs suppresses these prompts entirely.

Why the change to Apple's standard

• Loopback interception was losing reliability. Starting with macOS 11, Apple progressively restricted the undocumented behaviors that 1.x depended on. By macOS 13 Ventura, loopback-based filtering broke under specific conditions. This was not a DNSFilter-specific issue; any DNS security tool relying on loopback redirection faced the same erosion
• NetworkExtension is the only supported interception path. Apple's NEDNSProxyProvider API is the documented, entitlement-gated mechanism for DNS filtering on macOS. The agent's behavior is now defined by a stable API contract rather than undocumented OS internals
• MDM integration is first-class. System Extensions are designed for enterprise deployment. The com.apple.system-extension-policy and com.apple.dnsProxy.managed MDM payload types give IT teams explicit, auditable control over which network extensions are active on managed devices
• User-facing prompts are suppressible. With loopback, the agent required no approval but offered no MDM control. With System Extensions, MDM-managed devices get fully silent deployment, and unmanaged devices receive clear, OS-standard prompts

macOS compatibility timeline

• macOS 11 Big Sur (2020): Apple introduced stricter System Integrity Protection and began limiting loopback interception
• macOS 12 Monterey (2021): Tightened enforcement of DNS resolution paths
• macOS 13 Ventura (2022): Reduced support for non-System Extension network interception, breaking loopback-based filtering under some conditions
• macOS 14 Sonoma (2023): MDM gains load-order control for transparent proxy extensions. No breaking changes for 2.x agents
• macOS 15 Sequoia (2024): The System Extension approval UI moved to System Settings under General, then Login Items & Extensions (previously under Privacy & Security). Apple introduced a new Local Network Privacy permission, so apps accessing local network resources may trigger a separate user prompt. No breaking changes to NEDNSProxyProvider behavior for 2.x agents
• macOS 26 Tahoe (2026): Requires Apple Silicon; Intel Macs are no longer supported. Introduces the NEURLFilter URL Filtering API. No breaking changes to NEDNSProxyProvider behavior for 2.x agents

Technical features and differences