The payload that configures relay settings.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Relays Relays Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) An array of dictionaries that describe one or more relay servers that the system can chain together. 1 subkey | array | required | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) |
└─ Network relay Relay Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) 5 subkeys | dictionary | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) | |
└─ └─ HTTP/3 relay URL HTTP3RelayURL Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) The URL or URI template, as defined in RFC 9298, of a relay server that's reachable using HTTP/3 and supports proxying TCP and UDP using the CONNECT method.
Each relay needs to include either `HTTP2RelayURL` or `HTTP3RelayURL`, or it can include both. | string | optional | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) |
└─ └─ HTTP/2 relay URL HTTP2RelayURL Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) The URL or URI template, as defined in RFC 9298, of a relay server that's reachable using HTTP/2 and supports proxying TCP and UDP using the CONNECT method.
Each relay needs to include either `HTTP2RelayURL` or `HTTP3RelayURL`, or it can include both. | string | optional | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) |
└─ └─ Additional HTTP header fields AdditionalHTTPHeaderFields Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) A dictionary that contains custom HTTP header keys and values to add to each request. The dictionary key name represents the HTTP header field name to use, and the dictionary value is the string to use as the HTTP header field value. 1 subkey | dictionary | optional | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) |
└─ └─ └─ ANY ANY Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) The HTTP header field value for the corresponding header field name. | string | required | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) |
└─ └─ Certificate UUID PayloadCertificateUUID Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) The UUID that points to an identity certificate payload, which the system uses to authenticate the user to the relay server. | string | optional | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) |
└─ └─ Raw public keys RawPublicKeys Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) An array of DER-encoded raw public keys that the system uses to authenticate the server during a TLS handshake. The server needs to use one of the keys in the handshake to authenticate.
If this array is empty, the system uses the default TLS trust evaluation. 1 subkey | array | optional | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) |
└─ └─ └─ Raw public key element RawPublicKeysElement Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) | data | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) | |
Match domains MatchDomains Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) A list of domain strings that the system uses to determine which connection to route through the servers in `Relays`.
Any connection that matches a domain in the list exactly or is a subdomain of the listed domain uses the relay servers, unless it matches a domain in `ExcludedDomains`.
If this list and `MatchFQDNs` are empty, the system routes traffic to all domains to the relay servers, except those that match an excluded domain or excluded FQDN. 1 subkey | array | optional | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) |
└─ Match domains element MatchDomainsElement Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) | string | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) | |
Excluded domains ExcludedDomains Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) A list of domain strings to exclude from routing through the servers in `Relays`. Any connection that matches a domain in the list exactly or is a subdomain of the listed domain won't use the relay server. 1 subkey | array | optional | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) |
└─ Excluded domains element ExcludedDomainsElement Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) | string | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) | |
Match FQDNs MatchFQDNs Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) A list of Fully Qualified Domain Names (FQDNs) to route through the servers contained in `Relays`. Any connection that matches an FQDN in the list exactly uses the relay servers. If this list and `MatchDomains` are empty, the system routes traffic to all domains to the relay servers, except those that match an excluded domain or excluded FQDN. 1 subkey | array | optional | — | ✓Yes | iOS (18.4 - 27.0)macOS (15.4 - 27.0)tvOS (18.4 - deprecated)visionOS (2.4 - 27.0) |
└─ Match FQDNs element MatchFQDNsElement Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) | string | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) | |
Excluded FQDNs ExcludedFQDNs Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) A list of Fully Qualified Domain Names (FQDNs) to exclude from routing through the servers contained in `Relays`. Any connection that matches an FQDN in the list exactly won't use the relay server. When `MatchDomains` is also present, any FQDN listed in the list should be a subdomain of at least one `MatchDomain` value, otherwise it won't have any effect. 1 subkey | array | optional | — | ✓Yes | iOS (18.4 - 27.0)macOS (15.4 - 27.0)tvOS (18.4 - deprecated)visionOS (2.4 - 27.0) |
└─ Excluded FQDNs element ExcludedFQDNsElement Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) | string | — | ✓Yes | iOS (17.0 - 27.0)macOS (14.0 - 27.0)tvOS (17.0 - deprecated)visionOS (1.0 - 27.0) | |
Relay UUID RelayUUID Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) A globally unique identifier for this relay configuration. The system uses this UUID to route managed apps through the servers in `Relays`. This key is required for user enrollment. | string | optional | — | ✗No | |
UI toggle enabled UIToggleEnabled Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) If `true`, the device allows the user to disable this network relay configuration. | boolean | optional | true | ✓Yes | iOS (26.0 - 27.0)macOS (26.0 - 27.0)tvOS (26.0 - deprecated)visionOS (26.0 - 27.0) |
Allow DNS failover AllowDNSFailover Deprecated (iOS 27.0, macOS 27.0, visionOS 27.0) If `true`, the device allows the relay to failover to the default system DNS resolver. | boolean | optional | false | ✓Yes | iOS (26.0 - 27.0)macOS (26.0 - 27.0)tvOS (26.0 - deprecated)visionOS (26.0 - 27.0) |
Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.
com.apple.wifi.managed – Wi-Fi network configurationcom.apple.vpn.managed – VPN configurationcom.apple.applicationaccess – App and feature restrictionscom.apple.security.pkcs1 – Certificate (PKCS#1) payloadcom.apple.security.pkcs12 – Identity certificate (PKCS#12) payloadcom.apple.security.scep – SCEP certificate enrolmentcom.apple.mail.managed – Mail account configurationcom.apple.eas.account – Exchange ActiveSync accountcom.apple.MCX – Managed Client (macOS) preferencescom.apple.MCX.FileVault2 – FileVault 2 disk encryptioncom.apple.dock – macOS Dock configurationcom.apple.screensaver – Screensaver configurationcom.apple.loginwindow – macOS login window configurationcom.apple.systempolicy.managed – Gatekeeper / system policycom.apple.systempreferences – System Preferences pane restrictionscom.apple.SoftwareUpdate – Software update behaviourcom.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)com.apple.notificationsettings – Per-app notification settingscom.apple.webcontent-filter – Web content filtercom.apple.dnsSettings.managed – DNS settings (DoH / DoT)com.apple.relay.managed – Network relay configurationcom.apple.extensiblesso – Extensible Single Sign-Oncom.apple.configuration.passcode.settings – DDM: passcode policycom.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software updatecom.apple.configuration.services.configuration-files – DDM: service configuration filescom.apple.configuration.management.status-subscriptions – DDM: status subscriptionscom.apple.activation.simple – DDM: simple activation predicatecom.apple.management.organization-info – DDM: organization information