09/23 September 23 - macOS Roaming Client v2.4.6 Production

Version 2.4.6 of the macOS Roaming Client is now available on the

Production

channel. This release brings together every update from the 2.4 Beta series (v2.4.0 through v2.4.6). To install, download the latest production installer from the dashboard under

Deployments → Roaming Clients

. Auto-upgrades will roll out gradually.

⚠️ Action Required: Redeploy the Updated Certificate Profile

v2.4.6 checks for the new

DNSFilter Root CA G1

certificate. Devices that still have the previous certificate profile will show a

Fix Installation Issues

prompt in the menu bar after upgrading.

Filtering and protection keep working normally while the prompt is showing.

To clear the prompt, download the updated

Combined_Certificates.mobileconfig

(or the branded or white-label profile you deploy) from the Prerequisites section of the macOS Roaming Client install guide and push it through your MDM. The updated profile replaces the installed one in place. We recommend pushing it before auto-upgrade reaches your devices.

⚠️

Minimum macOS Version:

The macOS Roaming Client now requires macOS 13 Ventura or later.

✨ What's New

IPv6 Support
: Filtering and protection now cover IPv6 networks, so users on dual-stack and IPv6-only networks stay protected. Administrators can set upstream resolution to IPv4-only, IPv6-only, or automatic.
Filtering Stays On Through a VPN (Opt-In)
: Devices using encrypted DNS now keep DNSFilter filtering on while a corporate VPN is connected, even when the tunnel blocks the DNS-over-TLS port. Filtering switches to DNS-over-HTTPS, so remote and hybrid users on VPN stay protected and keep encrypted DNS. To turn it on for an install, set
ENABLE_DOH_FALLBACK=true
. The deployment guide covers setup and network requirements.
Component Version Mismatch Detection
: The Roaming Client now detects when the menu bar app, system extension, and daemon are running different versions, which can happen after upgrades or MDM-managed installs. When it finds a mismatch, it alerts the user, who can fix it from the menu.
Modernized Configuration Architecture
: The agent now uses a more resilient
configuration.json
format in place of the legacy
daemon.conf
. Configuration changes apply more reliably without restarting the agent, and existing installations migrate automatically on upgrade. Upstream protocol order settings, including DNS-over-TLS, now apply as configured.
Local Domains Stay Current
: Changes to local domains and resolvers made in the dashboard now apply right away, with no daemon restart needed, and internal domains stay on their assigned local resolvers after restarts and upgrades.

🛠️ Improvements

Every Certificate Root in One Profile
: The macOS certificate profiles now install all DNSFilter roots in a single push, including DNSFilter Root CA G1.
Travel Wi-Fi Keys Match the Docs
: Install-time configuration keys now use the same Travel Wi-Fi names as the dashboard and documentation, and Travel Wi-Fi settings in
dns_agent.conf
apply at CLI install. Existing scripts that use the previous names keep working.
More Resilient Connectivity
: The agent's connection handling and upstream failover have been rebuilt, so devices stay filtered as networks change, with less need for a manual restart.

🪲 Bug Fixes

Captive portals:
Captive portal detection is more accurate, the Access Captive Network option clears once you're connected, and Travel Wi-Fi appears as expected when configured through JSON
Site assignment:
Changing a device's Site Key now properly updates its site and policy in the dashboard
Menu bar:
The menu bar icon stays responsive and shows the right state when there's no network connection, and Travel Wi-Fi mode stays in the menu after a reboot
Diagnostics:
Diagnostics are collected more securely and include more complete information