<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">While digging around a bit, I have found a number of older posts regarding DNS and MacOS clients, and it seems like a bit of a mess. Among other things, it seems that MacOS will not use pushed DNS servers unless all traffic is tunneled. That does work for me. When sending all traffic across the tunnel (leftsubnet=0.0.0.0/0), the DNS server is pushed, and name resolution works just fine. However, I want to split traffic and have DNS queries for one specific domain sent to a DNS server on the other side of the tunnel, and that’s where things get squirrelly.<div class=""><br class=""></div><div class="">I looked at the Wiki’s recommendations here: <a href="https://wiki.strongswan.org/projects/strongswan/wiki/AppleClients" class="">https://wiki.strongswan.org/projects/strongswan/wiki/AppleClients</a></div><div class=""><br class=""></div><div class="">That pointed me to this: <a href="https://lists.strongswan.org/pipermail/users/2015-October/008844.html" class="">https://lists.strongswan.org/pipermail/users/2015-October/008844.html</a></div><div class=""><br class=""></div><div class="">And in the end, it seems that the only way to send traffic for one specific search domain to a DNS server on the other end of the tunnel is to use a configuration profile? Setting that up manually in the IPSec configuration does not work (then why allow it, Apple?!). </div><div class=""><br class=""></div><div class="">Am I missing anything?</div><div class=""><br class=""></div><div class="">Tom</div></body></html>