Encrypted DNS on iPhone and iPad: Profiles, Apps and DNSCrypt

What a configuration profile does

A DNS configuration profile is a small file containing Apple’s DNS Settings payload, type com.apple.dnsSettings.managed. It names a protocol, either HTTPS with a ServerURL template as in RFC 8484 or TLS with a ServerName as in RFC 7858, and optionally fixed ServerAddresses. Nothing else on the phone changes, and iOS lists the contents before you install.

Optional keys narrow its scope. SupplementalMatchDomains limits the server to domains, OnDemandRules switch it on or off per network the way VPN rules do, and ProhibitDisablement locks it, though only on supervised devices. From iOS 26, AllowFailover lets the device fall back to the default resolver. Apple marks the payload deprecated from iOS 27 in favour of a declarative configuration.

Installing a configuration profile for encrypted DNS on iPhone

Several resolver operators publish ready-made profiles on their own sites, usually one per filtering level. Download one in Safari, then finish the install in Settings within eight minutes, after which iOS deletes an uninstalled download. Apple also notes that Stolen Device Protection must be off for the install unless you are at a familiar location.

1. Download the profile from the resolver operator’s page.
2. Open Settings and tap Profile Downloaded.
3. Tap Install in the upper-right corner and confirm with the passcode.
4. Find it afterwards under Settings, General, VPN & Device Management.

A detail in Apple’s documentation surprises many readers: a profile installed by hand applies to cellular data as well as Wi-Fi, while the same payload pushed by a company’s device management only covers managed Wi-Fi networks. A personal install is therefore the broader one, which is usually what you want on a phone that roams.

Apps that set encrypted DNS

Apps can create the same configuration without a downloaded file. DNSecure, a free App Store tool, offers DoT and DoH servers: pick or add one and enable Use This Server, then go to Settings, General, the VPN section and DNS, and change Automatic to DNSecure. The app only writes the configuration; iOS does the actual work.

This is the most flexible way to get encrypted DNS on iPhone without a company’s device management. You can store several servers in one app and switch between them in seconds, which beats deleting and reinstalling profiles. The trade-off is trust: the app decides which server iOS uses, so prefer open tools with a clear author.

The same mechanism lies behind many resolver operators’ own apps. Cloudflare’s 1.1.1.1 app takes another route and installs a VPN profile when it first starts. Its documentation also describes the manual Configure DNS screen under each Wi-Fi network, which accepts only IP addresses and applies only to that one network, never to cellular.

DNSCrypt on iPhone

DNSCrypt is not one of the transports iOS understands, so it takes an app with a client inside. For years that was DNSCloak, a free wrapper around dnscrypt-proxy. Its App Store listing no longer resolves and its source repository has been quiet since November 2020, so it is not a current option.

AdGuard for iOS is the documented route left. Its DNS protection module accepts plain, DNSCrypt, DoH, DoT and DoQ servers. With AdGuard’s own implementation the app creates a local VPN that sends no traffic through remote servers; the Native implementation hands DNS to the system instead, which rules out local filtering and DoQ and fails while another VPN runs.

Verifying, and how to disable encrypted DNS on iPhone

After installing, open Settings, General, VPN & Device Management: a profile appears in the list, and an app-based configuration shows under the DNS entry. Then load any website on mobile data and on Wi-Fi. For a real check, run the resolver queries on the DNS leak check page from a laptop on the same configuration.

To disable encrypted DNS, reverse your route. A profile is removed from VPN & Device Management, and Apple’s guide warns that deleting a profile also deletes every setting it carried. An app-based configuration goes back to Automatic in the same DNS menu. If removal is refused, the device is supervised and only its administrator can disable encrypted DNS there.

Troubleshooting

• Profile vanished before installing: the eight-minute window passed; download it again.
• Install refused: check Stolen Device Protection, or install at a familiar location.
• Lookups fail on one network only: an OnDemandRules entry may exclude it, or the network blocks the resolver’s port.
• AdGuard Native mode does nothing: another VPN is active, so iOS ignores the native DNS setting.

Hotel and airport networks deserve a separate test, because their login pages sit between you and the internet until you accept their terms. If encrypted DNS on iPhone stops working only there, the public Wi-Fi guide explains how those portals interact with encrypted lookups and in which order to connect, log in and switch protection back on.