Open System Settings, search for Profiles, double-click
Haven Protective DNS, and click Install
A yellow "unverified" label is expected — your Mac is just noting the profile isn't from an app store.
Verify below
To undo later: System Settings → Profiles → Haven Protective DNS → Remove.
Prefer the command line? haven-protect.sh sets classic DNS
(revert): run with sudo sh ~/Downloads/haven-protect.sh.
Rather have someone talk you through it?
The Haven Guide will walk you through every tap and click, out loud,
at your pace — and wait for you between steps.
Starting it loads a voice widget from ElevenLabs, which
means your browser connects to them. Nothing on this page contacts them until you press the button.
Verify this device
Haven will try to reach two harmless test destinations that protective DNS should refuse. Nothing is downloaded.
You'll get the handful of things that actually cause this, each with a
way to tell whether it's yours before you change anything. Written by people and dated —
all of it is readable here without typing anything.