matchDomains did it! In order to disconnect, I set matchDomains to a bogus entry that should never be used, and the other domains went back to using the default resolver. This allows us to switch it "on" and "off" from within the app. Thank you! I can't seem change the correct answer once I selected it, but your last post should be the correct answer.

Sigh, ok, so we are back to square one. So then it seems we would have to implement DNS Proxy to do what we want? And it seems that other providers like NextDNS probably use this if they have DNS not connected to their VPN but can turn it on and off from within the app? Or do you have other thoughts now on how to accomplish this? Thanks! We do already have a Network Extension for VPN, but we'd prefer to be able to enable/disable our DoT without/outside the VPN if possible (ie they would be separate functions).

Actually, slight Edit. We are ok with going in to iOS Settings once when it's first loaded to switch to our DoT settings, but after that we'd like to be able to turn it on and off from within the app and haven't yet figured out how to do that without access to the isEnabled property on NEDNSSettingsManager. We can remove it altogether. But then we have to go back into Settings when we re-load it to enable it, which we are trying to avoid (and other apps seem to be able to disable and enable from within the app).

Well, it looks like I may have spoken too soon. The isEnabled property on NEDNSSettingsManager appears to be read only. Which means that we cannot flip .isEnabled ourselves from the app, which would mean that the user has to select it in Settings. And that property even says, "DNS settings must be enabled by the user in Settings or System Preferences." (The "working" version I mentioned was someone going into Settings and turning it on manually.) We need the ability to turn it on and off from within the app. Am I missing something?

We have an initial version working now, thank you!

Thank you for the quick response! In the information I came across before asking this question, it sounded like a toggle to turn system wide DNS on or off from within the app was impossible without the Network Extension? So just to clarify, will the DNS Settings API allow it to be turned on and off from within the app?

@DTS Engineer Our app has a minimum deployment target of 15.0 set in the app and in Podfile for IPHONEOS_DEPLOYMENT_TARGET. After integrating the WireGuardKit pod and loading a profile, we got this same problem (exactly as shown in https://forums.developer.apple.com/forums/thread/729690). (WireGuardKit on github and their primary download site also has 15.0 as minimum deployment target.) We have tried on phones running iOS 16.7.8, and phones running 17.6.1. Your solution above is the only one I've found, but either I'm misunderstanding the solution or it's not helping. Any other thoughts on a fix for this? Thanks!

I should probably also mention that in this case it is a forked version of a Cocoapod, so I can change things as needed.

Looks like i have a workaround for now using the following at the beginning of the methods that shouldn't be run in extensions: if ([[[NSBundle mainBundle] bundlePath] hasSuffix:@".appex"]) { return; // this is an app extension }

I forgot to mention, in the Podfile file, I have the following: post_install do |installer| installer.pods_project.targets.each do |target| target.build_configurations.each do |config| ... if target.name == "Notifications" config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] ||= ['$(inherited)', 'TARGET_IS_NOTIFICATION=1'] end ...