@Matt E: answered in the wrong thread, so see above. Did some testing of this. I'm trying to figure out if there is a way for a macOS app to pull in the DNS Settings preferences pushed from MDM using NEDNSSettingsManager's loadFromPreferences() function. I can't seem to do so, largely because I don't know if there is a way to target a bundle ID in the MDM profile for DNS Settings like there is for PacketTunnel and a few other NEs. This way I would be able to allow the app on the device to "control" the DNS Settings that were pushed via the MDM, which would be a suitable workaround for now. Also: I found evidence that DNS Settings is supposed to be captive portal aware, but that is for sure not happening on macOS (at least). Time to file a bug for that one?