How do I send my Mac’s DNS lookups to an encrypted resolver with Tattle?
In Tattle’s Settings › DNS, choose Tattle’s DNS proxy, pick a resolver (a preset, a personal-profile service with your own ID, or any DNS-over-HTTPS or DNS-over-TLS address) and apply it. Lookups then go through Tattle, encrypted, and appear in the main window’s DNS section. DNS is off until you do this.
Tattle isn’t out yet: the download button on the home page starts working on release day.
Two ways to set it up
Tattle’s DNS proxy answers lookups itself and sends them on to your resolver, encrypted. Blocklists and your domain block rules then apply to lookups too, and the DNS section lists each lookup with its answer (kept on your Mac for 7 days by default). Tattle connects to the resolver over HTTPS (HTTP/1.1) or TLS and checks its certificate against the resolver’s name.
The simple system mode makes a configuration profile for your resolver, which you install in System Settings › General › Device Management. macOS then sends lookups to the resolver itself; Tattle doesn’t see them, and can’t tell whether the profile is installed.
If the resolver stops answering
By default Tattle falls back to your network’s DNS servers, unencrypted, so a dead resolver never cuts your Mac off, and the DNS section says so. You can choose instead that lookups fail until the resolver answers again.
Limits macOS sets
VPNs: while a VPN is connected, macOS gives the VPN’s DNS precedence for the lookups it handles, and an always-on VPN can stop a DNS proxy altogether. Tattle’s DNS section says when a VPN’s DNS is in use, rather than claiming every lookup is encrypted.
Apps with their own DNS: apps that do their own encrypted DNS never reach Tattle’s proxy. Their connections are still seen and decided by the firewall.
Which app asked: macOS doesn’t tell a DNS proxy which app made most lookups, so the DNS log’s App column is usually empty.
Blocklists
In Settings › Blocklists you can subscribe to published lists of domains. Tattle downloads them from where each list is published, sending nothing about you, and blocks their names for every app, in lookups and connections. DNS over QUIC isn’t supported.