Subject: [Add] Testing DDR with macOS

From: Tommy Pauly <[email-masked]>
Date: Wed, 23 Feb 2022 09:52:00 -0800

Hello ADD,

I wanted to share with the group, for anyone who’s trying to bring up Discovery of Designated Resolvers (DDR, https://datatracker.ietf.org/doc/draft-ietf-add-ddr/ <https://datatracker.ietf.org/doc/draft-ietf-add-ddr/>) on their resolvers, that there is now a way to test this functionality with the current beta of macOS 12.3 <https://developer.apple.com/news/releases/?id=02152022e>. This is not enabled by default, but is a developer option.

In Terminal, you can run the following commands:

sudo defaults write /Library/Preferences/com.apple.networkd enable_ddr -int 1
sudo killall -9 mDNSResponder

The client will then start issuing SVCB queries for _dns.resolver.arpa, and using the results to verify resolvers and upgrade to encrypted DNS, either DoT or DoH.

Hopefully this can be a useful tool to you!

Best,
Tommy