Chromium-based browsers (Chrome, Edge, Brave) may ignore DNS settings deployed via .mobileconfig profiles on macOS. Here's why and how to fix it.
You've deployed CleanBrowsing DNS via a .mobileconfig profile on macOS (either manually or through an MDM like JAMF or Mosyle). Safari and other native apps respect the DNS settings and filtering works correctly.
However, Google Chrome and Microsoft Edge (and other Chromium-based browsers like Brave) seem to bypass the DNS profile entirely. Sites that should be blocked load normally in these browsers.
Chromium-based browsers have a built-in feature called Secure DNS (also known as DNS-over-HTTPS or DoH). When enabled, the browser sends DNS queries directly to a provider like Google or Cloudflare, bypassing the system DNS settings — including your .mobileconfig profile.
This is a privacy feature designed to encrypt DNS queries, but it has the side effect of overriding any DNS filtering configured at the system level.
Key points:
.mobileconfig profileschrome://settings/securityAlternatively, you can set it to use "With: Custom" and enter CleanBrowsing's DoH URL:
https://doh.cleanbrowsing.org/doh/family-filter/
defaults write com.google.Chrome DnsOverHttpsMode "off"
For a comprehensive guide on hardening Chrome policies, see How to Secure Google Chrome.
edge://settings/privacydefaults write com.microsoft.Edge DnsOverHttpsMode "off"
For more Edge hardening options, see How to Harden Microsoft Edge.
If you're deploying CleanBrowsing via MDM (JAMF, Mosyle, Intune), you should also deploy a Chrome/Edge policy profile that disables Secure DNS or points it to CleanBrowsing.
Create a .mobileconfig or plist with:
<key>DnsOverHttpsMode</key>
<string>off</string>
Or to force CleanBrowsing DoH:
<key>DnsOverHttpsMode</key>
<string>forced</string>
<key>DnsOverHttpsTemplates</key>
<string>https://doh.cleanbrowsing.org/doh/family-filter/</string>
If you manage Chrome browsers via Google Workspace, you can set the DNS-over-HTTPS policy from the admin console. See Configure DoH via Google Workspace.
For MDM deployment guides, see:
After disabling Secure DNS, verify that Chrome/Edge is now using CleanBrowsing:
You can also test by trying to access a domain that should be blocked by your filter. If the block page appears in Chrome/Edge, the fix is working.
For more verification methods, see How to Check If Your Browser Is Using Secure DNS.
Disable Secure DNS and enforce browser security policies.
Set up CleanBrowsing on macOS using system preferences or profiles.
Verify whether your browser is using encrypted DNS and which provider.