Thanks for the prompt reply Quinn! Honestly, this sounds like a bug, and I encourage you to file it as such [1]. Please post your bug number, just for the record. I've filed a feedback ticket. The number is: FB13551095

What do you mean here by the system DNS server and how are you deriving this information? Sorry, I mean the system DNS settings. I use the property systemDNSSettings in NEDNSProxyProvider for this and extract all the IP addresses from the servers array. The idea is that if the extension doesn't want to forward the query to a DoH server, it will forward it to one of the IP addresses it got from the systemDNSSettings. This method worked in iOS versions prior to 14.6, but since iOS 14.6 all UDP traffic I generate from the DNS extension also gets routed through the extension, causing a loop. Is this intended behaviour and if so: is there a way to prevent this? Thanks in advance!

Hi! Do I need to deploy the app to the Apple Store in order to deploy through the MDM? No, if you are part of the enterprise developer program you can archive the app from Xcode and export it as enterprise app. You’ll need to upload the IPA in your MDM. Do I need to deploy the app to the Apple Store in order to deploy through the MDM? No, just make sure you have an enterprise developer account and sign the IPA with a enterprise distribution certificate.