# Deploying SafeDNS Endpoint Lite for macOS via MDM
#### This guide explains how to deploy **SafeDNS Endpoint Lite for macOS** to multiple macOS devices using an MDM solution.
##### **The deployment consists of the following stages:**
- Create the **Config.plist** **script file** on the target devices.
- Create and install the required configuration profiles on the target devices using the script and .mobileconfig files.
- Install the SafeDNS daemon on the target devices using the [**safedns-daemon-20260515-1335-signed.pkg**](https://docs.safedns.com/attachments/6) package.
- Install the SafeDNS Endpoint Lite host and filtering module using the **SafeDNSMacProxy\_2026-05-14\_1744.pkg** package. (Provided from SafeDNS)
#### **1. Installing the agent on client devices**
##### Before deploying the agent at scale, complete the preparation steps below.
- Ask SafeDNS technical support (support@safedns.com) to enable the required features for your account.
- Obtain your **Base64-encoded AuthKey** from SafeDNS.
- Deploy the **[create-conf.sh](https://docs.safedns.com/attachments/7)** script to the target devices according to **[these instructions](https://docs.safedns.com/books/installation-guides/page/creating-the-configplist-file-for-safedns-endpoint-lite-on-macos)**.
- Create and install the two required configuration profiles on the target devices according to **[this guide](https://docs.safedns.com/books/installation-guides/page/create-and-deploy-configuration-profiles-for-safedns-endpoint-lite-on-macos).**
- Deploy the SafeDNS daemon to the target devices according to the [**SafeDNSDaemon installation guide**](https://docs.safedns.com/books/installation-guides/page/safednsdaemon-installation-via-mdm-on-macos).
After these steps are complete, you can deploy the **SafeDNS Endpoint Lite agent**.
Install the agent package, which includes the host and filtering module, in the same way as the SafeDNS daemon package, using the attached installer package.
#### **2. Uninstalling the agent**
##### To remove SafeDNS Endpoint Lite from target devices:
- Add the **SafeDNS Uninstaller** script to **Scripts** in SimpleMDM according to the [Running the SafeDNS Uninstaller script](https://docs.safedns.com/books/installation-guides/page/running-the-safedns-uninstaller-script) guide.
- Deploy the uninstaller script to the target devices in the same way as the **[create-conf.sh](https://docs.safedns.com/attachments/7)** script.
- Remove the **SafeDNS configuration profiles**, the **SafeDNS Endpoint Lite agent**, and the **SafeDNS daemon** from the target devices.
**IMPORTANT**
After removing the agent and the daemon, **RESTART** each target device.
The agent operates at the kernel level. After removal, some runtime records remain in the kernel until the device is restarted. If the device is not restarted, reinstalling the agent on the same device may cause errors or unstable behavior.
#### **3. Additional information**
#### Preventing DNS-over-HTTPS bypass in browsers
Advanced users **may try to bypass** system DNS filtering by configuring a custom DNS-over-HTTPS (DoH) resolver in Chromium-based browsers. The SafeDNS agent works with system DNS, so additional protection is required to reduce this risk.
SafeDNS provides two layers of protection against this scenario:
##### **1. Browser DNS policy configuration profile**
Create and deploy the **Safedns\_browser\_dns\_policy** custom configuration profile using the [Safedns\_browser\_dns\_policy.mobileconfig](https://docs.safedns.com/attachments/8) file.
This profile is deployed in the same way as the **SafeDNS\_DNS\_Proxy** custom configuration profile.
The profile restricts access to DNS-related settings in major browsers.
However, it does not cover all browsers. **Firefox is not included** in this policy.
##### **2. Built-in DoH bypass detection**
The SafeDNS filtering module includes a mechanism that detects attempts to bypass filtering through third-party DoH services and blocks those connections.
**Known limitation** If an advanced user manually configures a **self-hosted DoH resolver** or another non-standard **custom DoH solution** in the browser, DNS filtering may not work as expected.
####