Capture an app that ignores the proxy

Some apps never show up in the traffic list even with the macOS proxy on. Apps with their own network stack (gRPC, Network.framework), or payment and security SDKs, ignore the system proxy setting and connect straight to the internet. This guide finds those apps, captures them by answering the DNS lookups for their domains, and cleans up the resolver files afterwards.

What you need

The macOS proxy on (macOS traffic: On in the status bar)	Cloak Proxy detects direct connections only while the system proxy points at it
Your Mac password	Capturing adds a file per domain in /etc/resolver, which needs admin rights
An app you own or are authorized to test	You’re redirecting its domains to your Mac

Caution

This points a domain’s DNS at Cloak Proxy for every app on this Mac that uses it. Use it only for domains belonging to apps you own or are authorized to test, and stop capturing to remove the resolver files when you’re done.

Find the app

When the macOS proxy is on, Cloak Proxy watches for apps making direct connections and lists them under Not Using the Proxy in the sidebar.

12

The Not Using the Proxy section lists apps connecting straight to the internet.

1. Not Using the Proxy
2. App with direct connections — click to capture it

×

1. Use the app so it opens its connections. Within a few seconds it appears under Not Using the Proxy with a count of direct connections.

2. Click the app to open the capture sheet.

Tip

From the command line, cloakctl bypass-scan lists apps bypassing the proxy right now, which is handy for confirming before you capture.

Capture it

The capture sheet suggests the app’s own domains and lets you add more.

1234

The capture sheet: tick the domains to answer, then Capture.

1. Suggested domains — tick the ones to capture
2. Add a domain by hand
3. Cautions: /etc/resolver, password, pinned certs
4. Capture (asks for your password)

×

1. Review the Domains to capture. Cloak Proxy suggests domains that share a word with the app’s name or bundle id (from hosts it already used and strings in the app’s binary); others are listed unticked.

2. Tick the domains the app actually uses. Add any it’s missing in the Add a domain field (for example api.example.com).

3. Click Capture. macOS asks for your password to add a resolver file per domain, so lookups for those names (and their subdomains) go to Cloak Proxy.

4. Quit and reopen the app so it looks up its servers again. Its requests then appear in the traffic list.

Note

Captured domains are decrypted automatically — they were set up to be inspected, so you don’t need a separate SSL Proxying rule for them.

When the app pins its certificate

Some apps (and most payment SDKs) pin certificates and reject Cloak Proxy’s. When that happens, Cloak Proxy passes the connection through untouched so the app keeps working, and still lists the connection. The capture sheet shows pinned hosts in orange, and a failed, pinned connection is noted in the traffic list.

Caution

A pinned host can’t be decrypted. You’ll see that the app talks to it, but not the contents. This is expected and is not something to work around for an app you don’t control.

While Cloak Proxy is closed

Captured domains keep resolving even when the app isn’t running: a small background helper (started at login) answers those lookups normally, so the captured app keeps working. It steps aside the moment Cloak Proxy is open again.

Stop capturing and clean up

The resolver files stay on disk until you remove them, so clean up when you’re done.

1. Click the app under Not Using the Proxy (now shown as Captured) to reopen the sheet.

2. Click Stop Capturing. macOS asks for your password to remove the resolver files for those domains.

3. Repeat for any other captured app. When no captures remain, the background helper is removed too.

Note

If a resolver file was deleted by hand and the app’s state looks out of step, reopen the capture sheet and re-apply, or stop capturing, to bring /etc/resolver back in line. See Apps that ignore the proxy for the details.

Related

Apps that ignore the proxyThe Not Using the Proxy list, DNS capture, pausing and limits.

Network settingsReverse proxies, an alternative for apps that can't use a proxy.

macOS trafficTurning capture on, the proxy guard and bypass list.

cloakctlbypass-scan and the other command-line tools.