Part 1 · Chapter 0: What you're building, what it costs, and what it can't do

Kuuko is an app for iPhone and Mac. It blocks trackers, ads and scam sites, keeps no log of your lookups, and works inside the VPN you already use. Most people don't have the time, the server or the tools to build something like that. That's why the app exists.

But we don't want you to have to take our word for it. So here is how to build the core yourself, step by step, with every setting shown and explained.

Try Kuuko free for a week. Then keep it, or build it yourself — here's how.

What you'll have at the end

• Your own DNS resolver on a small server in the EU. Every time an app or a website asks for an address, your phone asks your server, encrypted.
• Blocking across all your apps and browsers. Trackers, ads and scam sites on your block lists get the answer "doesn't exist".
• Only your devices can use it. Your server answers only addresses that carry your private path. Everyone else is refused.
• It keeps working inside your VPN. Your iPhone uses your resolver also while a VPN such as Proton VPN is on. On the Mac we haven't tested this yet.
• No company in the middle. No DNS company or internet provider answers your devices' questions; your own server does. Your server looks each name up itself, asking the internet's name servers directly. Those questions travel unencrypted, as all ordinary DNS does, and each name server gets only the part of the name it's responsible for. You rent the server, the domain and the DNS hosting, and you can swap each of them for another.

The one idea to remember

Whoever sets up the tunnel decides the DNS. A VPN brings its own DNS, and on the iPhone it wins over yours. Chapter 9 shows how to take that decision back by deleting one line.

What it costs

Prices checked on 29 October 2026, without VAT.

In total: about €6 a month plus the domain, before VAT.

A setup of your own that works everywhere costs more than a Kuuko subscription (€4.99 a month or €39.99 a year).

How long it takes

It took us about two days for the DNS and the VPN part, including the mistakes this guide now warns you about. How long it takes you depends on how familiar you are with a terminal; each chapter gives our estimate.

How we tested this

Every part of this guide runs in our own setup, the one behind the Kuuko app. The guide is that setup, simplified for one person: the configs are ours, with the parts only an app needs taken out. We haven't followed this exact text from start to finish on a fresh server. Where something in it is untested or rebuilt from our notes, the chapter says so. If a step doesn't work as written, tell us: kuuko@sf4l.net.

What you need

• A computer with a terminal. We use a Mac.
• A password manager for your keys and tokens. Nothing secret ever goes into a chat or a note.
• An iPhone or a Mac to use it on. We tested on iPhone; the Mac steps are still to be tested. Android works differently and isn't covered yet.
• Patience to copy commands and read what each one does. You don't need to know how to program.

What it can't do

DNS blocking works by refusing to look up a tracker's name. That has limits, and we'd rather you know them now:

• Apps that talk to their own company. An app that already knows its servers' addresses doesn't need to look up a name. In our test, the Instagram app kept working while Safari couldn't open facebook.com.
• Trackers under a site's own name. A tracker at stats.example-shop.com looks like the shop itself. Your resolver does catch names that secretly point to known trackers (chapters 4 and 6), but not everything.
• Data sent from server to server. A shop can send what you bought straight to Meta. Your phone never sees that, so no blocker can stop it.
• It doesn't hide your IP address. That's what a VPN is for (chapter 9).
• If your server is down, your devices have no DNS until you switch back. Chapter 8 shows how to keep a way back.
• You're the operator now. Updates and renewals are your job (chapter 10).
• The iPhone profile has an end date. Apple lists the kind of profile this guide uses as available up to iOS 27. It still works today; chapter 8 explains.

What this guide leaves out, and the Kuuko app adds

This guide builds the core. The app adds what took us much longer:

• block categories you switch on and off, without an account;
• a "something broke" pause for the whole device that ends by itself after a few minutes;
• a protection test on the device, with one tap to independent test sites;
• resolvers on two servers, in Germany and Finland (you can add a second one later, see "Going further");
• email aliases that warn you when mail arrives from someone you never gave the alias to (Part 2 of this guide covers the core of aliases).

Without a server? (not tested by us)

• Mac alone: a small blocker runs on the Mac itself, and the Mac asks it at 127.0.0.1. Free and quick, but it protects only that Mac. Your iPhone gets nothing.
• A Mac at home for your other devices: the Mac must stay on and awake. It works only at home, unless you open your home network to the outside or use a connection service, which puts a company in the middle. On the iPhone, such a service is the one VPN allowed, so no Proton VPN at the same time.

That's why this guide uses a small server outside your home: no changes to your home network, it works while you travel, and it works alongside any VPN.

How every chapter works

1. Why: what the step protects you from, in one or two sentences.
2. Steps: every setting shown line by line, with what each line does. No "download this and run it".
3. How you know it worked: a command or a website, and the answer you should see.
4. Pitfalls: our own mistakes, at the step where they happened.
5. Time and cost: with the date the prices were checked.

Where you see <your-domain> or <your-server-ip>, put in your own.

The chapters

1. A domain of your own · /build/domain/
2. DNS hosting with DNSSEC · /build/dnssec/
3. A small server in the EU · /build/server/
4. The resolver · /build/resolver/
5. Certificates · /build/certificates/
6. Block lists that update themselves · /build/block-lists/
7. Logs that forget · /build/logs/
8. Your iPhone and Mac · /build/devices/
9. Your DNS inside your VPN · /build/vpn/
10. Keep it running · /build/upkeep/
11. If family or friends use it · /build/sharing/

Going further

Not covered step by step yet:

• A second server in another country. If one is down, your devices use the other. Both need the same certificate, so use the DNS check instead of the port 80 one: certbot writes a short-lived record at deSEC, with a token that may write only that one record.
• Your own small app. When Apple removes the DNS profile (chapter 8), an app of your own can set the same encrypted DNS, also inside a VPN. It needs a Mac with Xcode and Apple's paid developer membership (99 USD a year).
• Part 2: your own email aliases. One address per shop, on your own mail server. Coming later.

Sources

Prices checked 29 October 2026; they change, so check them on the day you order.

• Server prices: CostGoat, Hetzner Cloud pricing (updated 20 October 2026) and Bitdoze, Hetzner cost-optimized plans (checked 20 October 2026).
• Domain prices: DomainOffer, cheapest .com registrars 2026 (verified May 2026).
• deSEC: interview with deSEC on Nextcloud's blog (May 2021).
• What DNS blocking can't do: What Kuuko can't block.
• VPN providers with WireGuard configs: VPNs that work (checked 28 October 2026).

---

Text: CC BY-SA 4.0 · Commands and configs: CC0 · SF4L S.R.L., Bucharest